Cross-origin iframe with joined
document.domain