I don't think this oddity could be used for any of those things. The pages that you would attack or defraud are not recursively loading themselves in iframes. I

I don't think this oddity could be used for any of those things. The pages that you would attack or defraud are not recursively loading themselves in iframes. If you wanted to do any of that you would just load many iframes with the same URL with some meaningless query parameters on it, as from a caching perspective, a URL which differs only by it's query parameters is a different URL.