After the initial setting of src, each additional reload the src = is ignored.
I've attached a reduction. Simply load the page, and then click on any link in the iframe. Then, hit refresh. You'll notice that the page loaded is the linked to page, not the original page, which is incorrect because the script is explicitly setting the src attribute. The only way to fix this is to keep reseting the name attribute of the iframe.
Created attachment 21583 [details]
My initial comment for this bug describes how to use this reduction.
I can reproduce this with shipping Safari, but not with ToT. Likely fixed with bug 3580.
*** This bug has been marked as a duplicate of 3580 ***