UserAgent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.12; rv:50.0) Gecko/20100101 Firefox/50.0

Steps to reproduce the problem:
1. Create a site with an iframe with sandbox-attribute that has no allow-same-origin value that
2. The content of the sandboxed iframe calls window.sessionStorage

What is the expected behavior?
Since the W3C-spec ( https://www.w3.org/TR/html5/embedded-content-0.html#the-iframe-element ) disallows access to localStorage but still allows accessing the sessionStorage, I would expect the gain access to some kind of sessionStorage. Since the content of the iframe has a unique origin, I would expect that sessionStorage to be unique as well, so it exists only within that iframe.

What went wrong?
The JS throws a security exception. This is due to the discussion here: https://bugs.webkit.org/show_bug.cgi?id=38151

But I really think that this behavious is wrong. Maybe it was just a workaround, because back then the sessionStorage was not unique. But it causes other problems. Using the JS-API in a correct way should not cause exceptions that destroy the whole page.

Did this work before? No 

Chrome version: 55  Channel: stable
OS Version: OS X 10.12
Flash Version: Shockwave Flash 24.0 r0