A plain sandbox="" (empty value) iframe loads a same-origin page. What is true about scripts and form submission in that frame?