Sandboxes can request fully qualified resources.

TL;DR sandbox includes "allow-same-origin", possibly for a good reason, possibly
to work around a chrome bug.

Sandboxes may need to create non-Oasis iframes and communicate with them.  Such
iframes might be fully qualified.  In chrome, a null origin iframe cannot post a
message using `postMessage` to a fully qualified frame, with a `targetOrigin` of
anything other than `*`.  In particular, a message with the correct (but
non-`*`) target origin is rejected.

This seems to me like a Chrome bug, but there's a chance I'm misreading the spec.