http/tests/security/document-all.html

<script>
if (window.testRunner) {
    testRunner.dumpAsText();
    testRunner.waitUntilDone();
}

window.onload = function()
{
    frame = document.body.appendChild(document.createElement("iframe"));
    frame.src = "http://localhost:8080/security/resources/innocent-victim-with-iframe.html";
    frame.onload = function() {
        frame.onload = null;

        frame.contentWindow[0].location = "data:text/html,<script>(" + function() {

            setTimeout(function() {
                if (window.testRunner)
                    testRunner.notifyDone();
            }, 0);

            window.name = "alert";
            obj = document.all;
            obj.__proto__ = parent;
            alert(obj.alert.constructor("return document.body.innerHTML")());
        } + ")()</scr" + "ipt>";
    }
}
</script>