Changing an iframe from cs.ru.nl via the DOM
Click anywhere in this sentence to change the frame.
And click anywhere in this sentence to change it back.
Accessing the location field of the frame is only allowed
for the same domain if it comes form the same domain, ie. ru.nl.
Setting the location field of the frame is always allowed; for other fields it is typically not allowed.
Try to think of examples where an attacker might be interested in doing this.