Why the need for a "sub-ms" timer implementation? Just do a while loop and constantly check for the SOP exception (or for Xms to have elapsed). Set a timeout between checking URLs. The ~10ms blocking of each URL check will not be noticeable to the UI.

Nice PoC though, and thanks for the lack of press release ;)

Edit: I just tried this out and it appears that the looping JS blocks the iframe from loading. I would have figured the iframe would be a separate JS thread. I'm wondering -- do all iframes share the same JS thread? Can one iframe block another? Anyway, it's clear that some sort of asynchronous solution is necessary.