<html>
<head>
<script>

// this assignment should have no effect on sandbox status
self.sandbox = 'allow-scripts allow-same-origin hacked-via-window-object';

// this should be prevented by the sandbox 'origin' flag
if (top.document)
    top.document.getElementById('f').sandbox = 'allow-scripts allow-same-origin hacked-via-dom';

</script>
</head>
</html>