JScript: document.open('text/html', 'replace') trouble in IE6

Hi everyone,

I read "Internet Explorer 6 Hacks And Holes Exposed" Mitchell's story [1] and I wonder if any of you is aware of an additional problem regarding JScript document.open method params -- triggered on URL

IE6 does not seem to honor the value of sName optional param when it is set to "replace" string [2]: "When opening up a new document, specifying the String replace for sName designates that the new document is to replace the current document in the history list". In a javascript quiz [3] I developed 2 years ago, each question is being written to the same frame and obviously should not generate an entry in window history. But in IE6, it's a whole different story since each question is being added to the IE6 history list (!) and calling top.history.back() doesn't even restore the 'previous' page as intended (works in all browsers, Opera excepted -- but support for JavaScript isn't perfect in this particular browser).

Any idea? Do I need to add some IE6-specific code?

Thanks in advance,

[1] URL

[2] URL

[3] URL

Michael,
Have you tried replacing the JavaScript with the equivelant server-side code to perform the marking, etc on the server-side?

Already have at hand a server-side quiz written in PHP when we were organizing contests and people could win some prizes... this way they could not peek at the source code and get the right answers. On the other hand, the 2 JavaScript quizzes I have written are here only for fun. They do have an advantage over the server-side script: they load in one pass and keep the state w/o making any further request to the server. And I'm not enclined to convert the whole thing to PHP (or Perl) just because Microsoft IE6 has changed the rules regarding its handling of document.open params. Is there a way to contact Microsoft and warn them there is a bug within the IE6 JScript implementation? Or again maybe there is a work-around ?[*]
[*] I tried to assign the html code to a variable (e.g. nextQ) and then invoke location.replace("javascript: nextQ") for the current frame... Though it works in NS4 and Mozilla, it doesn't work at all with IE5.x Mac (doesn't go any further than 2nd question; seems to be a memory leak problem but I don't have much time to investigate)