Address Bar Spoof via New Window Reload

Opening a new window that server-redirects to Bing, and immediately calling location.reload() on it, causes the address bar of the new window to remain stuck on the original URL while Bing’s content loads. The reload interrupts the address bar update cycle at just the right moment.

function main() {
    var win = window.open("redir.aspx");
    win.location.reload(); // This makes the address bar stay the same.
}

If the result is cached, clearing the browser cache and retrying is necessary for reliable reproduction. This variant was slightly cleaner than the earlier replaceState-based spoof because it did not require history.replaceState at all — just window.open and reload in immediate sequence. Tested on Win8 IE10 Updated and Win7 IE11 build 20130225-2100.

Found during my years at Microsoft (2006–2014). These bugs were patched long ago — shared here as a historical record for learning purposes.