HTML's DOM, or Document Object Model, lets you replace an iframe's HTML code by giving JavaScript's getElementById function access the "src" attribute.

I've been a fan of using iframe instead of object/embed/etc since the 90s, but all the guides kept saying to use object tags. IMO, iframe tags are shorter and more flexible. They avoid all that ...

This could be exploited to cause a buffer overflow via a malicious HTML document containing overly long strings in the "SRC" and "NAME" attributes of the <IFRAME> tag.