chromium/content/test/data/navigation_controller/inject_subframe_into_blank_iframe.html

<html>
<head></head>
<body>
  <p>This page injects an inner frame into an injected blank iframe.
  <div id="myDiv"></div>
  <script>
    var outerIframeHtml = '<iframe src="about:blank" id="outer"><\/iframe>';
    var innerIframeHtml = '<iframe src="form.html"><\/iframe>';

    // Create an empty about:blank iframe inside the preexisting div.
    document.getElementById('myDiv').innerHTML = outerIframeHtml;

    // Populate that empty iframe via doc.write, in a way that causes a request.
    var iDoc = document.getElementById('outer').contentWindow.document;
    iDoc.open();
    iDoc.write(innerIframeHtml);
    iDoc.close();
  </script>
</body>
</html>