Can you please clarify how this example works:

var iframe = document.createElement('IFRAME');
//have the IFRAME download the content we want to steal
iframe.src = 'http://site.com/AddressBook.php);
//make the IFRAME invisible
iframe.style="width:0px; height:0px; border: 0px"
//set our function to call when the IFRAME is done loading
iframe.onload = callbackFunction;
//now add the IFRAME to the DOM.
Document.body.appendChild(iframe);

From what I can tell, the above code will only work if this script is included on the site.com domain. iframes prevent access to their data by parent windows of different domain names. Therefore, I don’t see how an attacker can access this data?

I use this technique in one of my applications to pass data from one website to another, but I have control of both websites. I placed a script tag on domainA from domainB. without access to domainA, I don’t see how this can be accomplished.

I hope my question is clear. Please email me if it’s not as I feel it’s important that I understand the security implications of this technique for my product.

Thanks,
James