You can do this:
Have an
<html>
<head>
<script language="javascript">
function runEval()
{
var ownURL = window.location.href;
var doEvalHex = ownURL.substring(ownURL.indexOf('?doEvalHex=')+'?doEvalHex='.length);
var doEvalStr = hexToStr(doEvalHex);
with(window.parent) // critical
{
eval(doEvalStr);
}
}
</script>
</head>
<body onLoad="runEval();">
</body>
<html>
Run with:
String js = "var anythingGoes = function() { setTimeout(function(){ window.alert("function in function");}, 1000)}";
this.getAppletContext().showDocument(new URL("./myEval.html?doEvalHex="+strToHex(js)), "myEval"); // not _self
I have something like that (as a workaround in Opera, as it doesn’t understand the “javascript:…”-protocol). It works, but the provided code is untested.