Browser Shredders Challenge #1

For some time now I haven't succeeded in triggering password autofill in any iOS browser from a downloaded HTML file (which would allow another easy way to steal passwords). There are no Same Origin Policy constraints for local HTML files, so it seems easy to just open the target website and read the password, but there are some problems:
- password autofill does not work in cross-domain frames in iOS browsers based on UIWebView
- calling window.open() overwrites the calling window, so I cannot control content while having the target website open
-  I didn't find any other way to set location.host or mainDocumentURL.host to target domain while still controlling the content

I guess there may be some solution which I overlooked, so here is the challenge for you:

	- (void)viewDidLoad
	{
	[super viewDidLoad];
	webView.delegate = self;
	[webView loadRequest:[NSURLRequest requestWithURL:[NSURL URLWithString:@"file:///tmp/challenge1.html"]]];
	}
	- (void)webViewDidFinishLoad:(UIWebView *)lWebView
	{
	if([lWebView.request.mainDocumentURL.host isEqualToString:@"example.com"]
	&& [[lWebView stringByEvaluatingJavaScriptFromString:@"location.host"] isEqualToString:@"example.com"]
	&& [[lWebView stringByEvaluatingJavaScriptFromString:@"document.forms[0].id"] isEqualToString:@"challenge1"]) {
	NSLog(@"You completed the challenge!");
	}
	}

view raw gistfile1.m hosted with ❤ by GitHub

A sample application with the code above - which you may run on iOS simulator - is available on GitHub. The task is to prepare a local HTML file (/tmp/challenge1.html) in such way that "You completed the challenge" line will get executed.

There is no reward unfortunately, apart from a humble "thank you" during our SyScan360 talk :-)