1. https://iframe-session-history.glitch.me/
2. Click "navigate to hash"

This creates the following session history:

Then:

3. Click "navigate to JavaScript URL"

Using terminology from the model I'm working on in #6315, Chrome seems to replace the document in the current document state. So:

That means clicking back and forth does not change the document.

Whereas Firefox seems to replace the document state of the current entry:

This means going back & forth takes you to a different document.

It also initially discards page-doc, so it'll reload when traversing back. But then you can go back and forth getting entries from the bfcache.

In both cases, if the js-doc is discarded or the entry is reloaded, /#foo is fetched.

Safari doesn't seem to support javascript: URLs returning strings.

I don't really have a preference of behaviour here. Safari's is simplest 😄