We're creating <iframe>s dynamically (e.g. for a rich text editor or a debug window) and inj