code: function() {
        var that   = this,
            iframe = doc.createElement("iframe");
        iframe.className = "wysihtml5-sandbox";
        wysihtml5.dom.setAttributes({
          "security":           "restricted",
          "allowtransparency":  "true",
          "frameborder":        0,
          "width":              0,
          "height":             0,
          "marginwidth":        0,
          "marginheight":       0
        }).on(iframe);
  
        // Setting the src like this prevents ssl warnings in IE6
        if (wysihtml5.browser.throwsMixedContentWarningWhenIframeSrcIsEmpty()) {
          iframe.src = "javascript:'<html></html>'";
        }
  
        iframe.onload = function() {
          iframe.onreadystatechange = iframe.onload = null;
          that._onLoadIframe(iframe);
        };
  
        iframe.onreadystatechange = function() {
          if (/loaded|complete/.test(iframe.readyState)) {
            iframe.onreadystatechange = iframe.onload = null;
            that._onLoadIframe(iframe);
          }
        };
  
        return iframe;
      }
docs: Creates the sandbox iframe
  
  Some important notes:
  - We can't use HTML5 sandbox for now:
  setting it causes that the iframe's dom can't be accessed from the outside
  Therefore we need to set the "allow-same-origin" flag which enables accessing the iframe's dom
  But then there's another problem, DOM events (focus, blur, change, keypress, ...) aren't fired.
  In order to make this happen we need to set the "allow-scripts" flag.
  A combination of allow-scripts and allow-same-origin is almost the same as setting no sandbox attribute at all.
  - Chrome & Safari, doesn't seem to support sandboxing correctly when the iframe's html is inlined (no physical document)
  - IE needs to have the security="restricted" attribute set before the iframe is
  inserted into the dom tree
  - Believe it or not but in IE "security" in document.createElement("iframe") is false, even
  though it supports it
  - When an iframe has security="restricted", in IE eval() & execScript() don't work anymore
  - IE doesn't fire the onload event when the content is inlined in the src attribute, therefore we rely
  on the onreadystatechange event