001/sandbox-eval/frame.html'></iframe>

    <script>
      window.localStorage['sekrit'] = '[insert sensitive information here]';
      var sandboxedFrame = document.getElementById('sandboxed');
      var unsandboxedFrame = document.getElementById('unsandboxed');

      function evaluate(frame) {
        var code = document.getElementById('code').value;
        // Note that we're sending the message to "*", rather than some specific
        // origin. Sandboxed iframes which lack the 'allow-same-origin' hea