Can you elaborate? Do you have an example of what you have in mind?

http://example.org

<iframe src=http://foo.example.org/></iframe>
<script>
document.domain = 'example.org';
onload = function(){
  window[0].document.write('foo');
}
</script>


http://foo.example.org

<script>
document.domain = 'example.org';
</script>

Isn't the document recycled in that case? Thus the origin doesn't change?

"Unload the Document object, with the recycle parameter set to true."

So, yes. For some reason this wasn't clear to me when I filed the bug. It was clear when I read it now, so closing.