Drive it with: python tools/xss.py postmsg --url <lab-url> --payload '<img src=x onerror=...>'
Send a string to this frame and it becomes innerHTML.