der
        // don't have an origin which you can target: you'll have to send to any
        // origin, which might alow some esoteric attacks. Validate your output!
        frame.contentWindow.postMessage(code, '*');
      }

      document.getElementById('unsafe').addEventListener('click', function () {
        evaluate(unsandboxedFrame);
      });
      document.getElementById('safe').addEventListener('click', function () {
        evaluate(sandboxedFrame);
      });

      // Listen for response message