IE10: createDocument Documents Load External Content via video, audio, bgsound, and HTC Behavior

I found that documents created via document.implementation.createDocument() were supposed to be prevented from loading external content, but several tag types bypassed this restriction. <video>, <audio>, <bgsound>, and style="behavior:url(...)" all fired real network requests and received responses. <embed> and <object> sent requests but received empty responses (Content-Length: 0). The same behavior was reproducible with createHTMLDocument.

var myDoc = document.implementation.createDocument("http://www.w3.org/1999/xhtml", "html", null);
myDoc.all[0].innerHTML = '<video src="dummy.html?video"></video>' +
                         '<audio src="dummy.html?audio"></audio>' +
                         '<bgsound src="dummy.html?bgsound" />' +
                         '<div style="behavior:url(dummy.html?htc)"></div>' +
                         '<embed src="dummy.html?embed"></embed>' +
                         '<object data="dummy.html?object"></object>';

Monitoring network traffic with Fiddler confirmed that dummy.html?video, dummy.html?audio, dummy.html?bgsound, and dummy.html?htc all received full responses. The embed and object requests were sent but returned with Content-Length: 0, suggesting a partial mitigation. This opened a potential side-channel for content probing from detached documents.

Found during my years at Microsoft (2006–2014). These bugs were patched long ago — shared here as a historical record for learning purposes.