Navigating bfcache isn't guarded by sandboxing #4121
Description
As far as I can tell the standard as-is doesn't guard a sandboxed <iframe> from navigating the top-level browsing context with history.back() if the previous entry holds a Document object.