I'm pretty sure this is doing what it's supposed to. The sandbox constructor can take either a window object or a URL, but we should pass a window object whenever possible because, if a page sets `document.domain`, SOP rules change and can no longer be inferred from the URL alone.