It turned out that I need to a little more attention to the case where iframe is moved within beforeunload event handler.
I end up hitting an assert I added in DisallowNavigationInBeforeUnload's c'tor and d'tor now.