The following iframe uses the allow and src attributes:

Try: iframe navigated by script -- no src specified