hack.js

var contents = '<form action="https://httpbin.org/post" method="POST">';
contents += '<input name="secret" placeholder="Secret stuff here">';
contents += '<input type="submit" onclick="return hack()">';
contents += '<script type="text/javascript">';
contents += 'function hack() { alert("h4x0rz"); }';
contents += '</script>';
contents += '</form>';
document.getElementById('frame1').src = "data:text/html;charset=utf-8," + escape(contents);

i-dont-matter.html

<form action="https://httpbin.org/post" method="POST">
  <input name="secret" placeholder="Secret stuff here">
  <input type="submit">
</form>

index.html

<p>IFRAME below</p>
<iframe id="frame1" src="http://localhost:8000/i-dont-matter.html"></iframe>

run.sh

python -m SimpleHTTPServer

Python 3: python -m http.server