LayoutTests/http/tests/security/window-named-proto.html

<script>
if (window.testRunner) {
    testRunner.dumpAsText();
    testRunner.waitUntilDone();
}

window.onload = function()
{
    frame = document.body.appendChild(document.createElement("iframe"));
    frame.src = "http://localhost:8080/security/resources/innocent-victim-with-iframe.html";
    frame.onload = function() {
        frame.onload = null;

        frame.contentWindow[0].location = "data:text/html,<script>(" + function() {

            setTimeout(function() {
                if (window.testRunner)
                    testRunner.notifyDone();
            }, 0);

            window.name = "__proto__";
            parent.__proto__.alert.constructor("alert(document.body.innerHTML)")();
        } + ")()</scr" + "ipt>";
    }
}
</script>