diff --git a/dlls/mshtml/htmlevent.c b/dlls/mshtml/htmlevent.c
index 31adc7907bc..4b201c4c463 100644
--- a/dlls/mshtml/htmlevent.c
+++ b/dlls/mshtml/htmlevent.c
@@ -1386,7 +1386,7 @@ void check_event_attr(HTMLDocumentNode *doc, nsIDOMElement *nselem)
 
             TRACE("%p.%s = %s\n", nselem, debugstr_w(event_info[i].attr_name), debugstr_w(attr_value));
 
-            disp = script_parse_event(doc->basedoc.window, attr_value);
+            disp = script_parse_event(doc->basedoc.window->base.inner_window, attr_value);
             if(disp) {
                 hres = get_node(doc, (nsIDOMNode*)nselem, TRUE, &node);
                 if(SUCCEEDED(hres)) {
diff --git a/dlls/mshtml/htmlwindow.c b/dlls/mshtml/htmlwindow.c
index f6d62122002..c20d765d5b9 100644
--- a/dlls/mshtml/htmlwindow.c
+++ b/dlls/mshtml/htmlwindow.c
@@ -208,8 +208,6 @@ static void release_outer_window(HTMLOuterWindow *This)
     This->window_ref->window = NULL;
     windowref_release(This->window_ref);
 
-    release_script_hosts(This);
-
     if(This->nswindow)
         nsIDOMWindow_Release(This->nswindow);
 
@@ -221,6 +219,8 @@ static void release_inner_window(HTMLInnerWindow *This)
 {
     unsigned i;
 
+    release_script_hosts(This);
+
     htmldoc_release(&This->doc->basedoc);
     release_dispex(&This->dispex);
 
@@ -1183,7 +1183,7 @@ static HRESULT WINAPI HTMLWindow2_execScript(IHTMLWindow2 *iface, BSTR scode, BS
 
     TRACE("(%p)->(%s %s %p)\n", This, debugstr_w(scode), debugstr_w(language), pvarRet);
 
-    return exec_script(This->outer_window, scode, language, pvarRet);
+    return exec_script(This->inner_window, scode, language, pvarRet);
 }
 
 static HRESULT WINAPI HTMLWindow2_toString(IHTMLWindow2 *iface, BSTR *String)
@@ -1468,7 +1468,7 @@ static HRESULT window_set_timer(HTMLInnerWindow *This, VARIANT *expr, LONG msec,
         break;
 
     case VT_BSTR:
-        disp = script_parse_event(This->base.outer_window, V_BSTR(expr));
+        disp = script_parse_event(This->base.inner_window, V_BSTR(expr));
         break;
 
     default:
@@ -2238,7 +2238,7 @@ HRESULT search_window_props(HTMLInnerWindow *This, BSTR bstrName, DWORD grfdex,
         }
     }
 
-    if(find_global_prop(This->base.outer_window, bstrName, grfdex, &script_host, &id)) {
+    if(find_global_prop(This->base.inner_window, bstrName, grfdex, &script_host, &id)) {
         global_prop_t *prop;
 
         prop = alloc_global_prop(This, GLOBAL_SCRIPTVAR, bstrName);
@@ -2580,6 +2580,8 @@ static HRESULT create_inner_window(HTMLOuterWindow *outer_window, HTMLDocumentNo
     if(!window)
         return E_OUTOFMEMORY;
 
+    list_init(&window->script_hosts);
+
     window->base.outer_window = outer_window;
     window->base.inner_window = window;
 
@@ -2623,7 +2625,6 @@ HRESULT HTMLOuterWindow_Create(HTMLDocumentObj *doc_obj, nsIDOMWindow *nswindow,
 
     window->scriptmode = parent ? parent->scriptmode : SCRIPTMODE_GECKO;
     window->readystate = READYSTATE_UNINITIALIZED;
-    list_init(&window->script_hosts);
 
     hres = update_window_doc(window);
     if(FAILED(hres)) {
@@ -2663,7 +2664,7 @@ static HRESULT window_set_docnode(HTMLOuterWindow *window, HTMLDocumentNode *doc
             window->base.inner_window->doc->basedoc.cp_container.forward_container = NULL;
         detach_events(window->base.inner_window->doc);
         abort_document_bindings(window->base.inner_window->doc);
-        release_script_hosts(window);
+        release_script_hosts(window->base.inner_window);
     }
 
     if(doc_node) {
diff --git a/dlls/mshtml/mshtml_private.h b/dlls/mshtml/mshtml_private.h
index 35800d8a497..de0a23777aa 100644
--- a/dlls/mshtml/mshtml_private.h
+++ b/dlls/mshtml/mshtml_private.h
@@ -334,7 +334,6 @@ struct HTMLOuterWindow {
     IHTMLEventObj *event;
 
     SCRIPTMODE scriptmode;
-    struct list script_hosts;
 
     IInternetSecurityManager *secmgr;
 
@@ -354,6 +353,8 @@ struct HTMLInnerWindow {
 
     HTMLDocumentNode *doc;
 
+    struct list script_hosts;
+
     HTMLOptionElementFactory *option_factory;
 
     global_prop_t *global_props;
@@ -843,13 +844,13 @@ void release_nodes(HTMLDocumentNode*) DECLSPEC_HIDDEN;
 
 HTMLElement *unsafe_impl_from_IHTMLElement(IHTMLElement*) DECLSPEC_HIDDEN;
 
-void release_script_hosts(HTMLOuterWindow*) DECLSPEC_HIDDEN;
-void connect_scripts(HTMLOuterWindow*) DECLSPEC_HIDDEN;
-void doc_insert_script(HTMLOuterWindow*,nsIDOMHTMLScriptElement*) DECLSPEC_HIDDEN;
-IDispatch *script_parse_event(HTMLOuterWindow*,LPCWSTR) DECLSPEC_HIDDEN;
-HRESULT exec_script(HTMLOuterWindow*,const WCHAR*,const WCHAR*,VARIANT*) DECLSPEC_HIDDEN;
+void release_script_hosts(HTMLInnerWindow*) DECLSPEC_HIDDEN;
+void connect_scripts(HTMLInnerWindow*) DECLSPEC_HIDDEN;
+void doc_insert_script(HTMLInnerWindow*,nsIDOMHTMLScriptElement*) DECLSPEC_HIDDEN;
+IDispatch *script_parse_event(HTMLInnerWindow*,LPCWSTR) DECLSPEC_HIDDEN;
+HRESULT exec_script(HTMLInnerWindow*,const WCHAR*,const WCHAR*,VARIANT*) DECLSPEC_HIDDEN;
 void set_script_mode(HTMLOuterWindow*,SCRIPTMODE) DECLSPEC_HIDDEN;
-BOOL find_global_prop(HTMLOuterWindow*,BSTR,DWORD,ScriptHost**,DISPID*) DECLSPEC_HIDDEN;
+BOOL find_global_prop(HTMLInnerWindow*,BSTR,DWORD,ScriptHost**,DISPID*) DECLSPEC_HIDDEN;
 IDispatch *get_script_disp(ScriptHost*) DECLSPEC_HIDDEN;
 HRESULT search_window_props(HTMLInnerWindow*,BSTR,DWORD,DISPID*) DECLSPEC_HIDDEN;
 
diff --git a/dlls/mshtml/mutation.c b/dlls/mshtml/mutation.c
index 6a25346a50b..e81011021f6 100644
--- a/dlls/mshtml/mutation.c
+++ b/dlls/mshtml/mutation.c
@@ -316,7 +316,7 @@ static nsresult run_insert_script(HTMLDocumentNode *doc, nsISupports *script_ifa
     if(nsparser)
         nsIParser_BeginEvaluatingParserInsertedScript(nsparser);
 
-    doc_insert_script(doc->basedoc.window, nsscript);
+    doc_insert_script(doc->basedoc.window->base.inner_window, nsscript);
 
     if(nsparser) {
         nsIParser_EndEvaluatingParserInsertedScript(nsparser);
diff --git a/dlls/mshtml/navigate.c b/dlls/mshtml/navigate.c
index 3c536a35725..3fec433aab6 100644
--- a/dlls/mshtml/navigate.c
+++ b/dlls/mshtml/navigate.c
@@ -1807,7 +1807,7 @@ static void navigate_javascript_proc(task_t *_task)
     set_download_state(window->doc_obj, 1);
 
     V_VT(&v) = VT_EMPTY;
-    hres = exec_script(window, code, jscriptW, &v);
+    hres = exec_script(window->base.inner_window, code, jscriptW, &v);
     SysFreeString(code);
     if(SUCCEEDED(hres) && V_VT(&v) != VT_EMPTY) {
         FIXME("javascirpt URL returned %s\n", debugstr_variant(&v));
diff --git a/dlls/mshtml/nsevents.c b/dlls/mshtml/nsevents.c
index 56d43847d94..e6d6fbcaefc 100644
--- a/dlls/mshtml/nsevents.c
+++ b/dlls/mshtml/nsevents.c
@@ -241,7 +241,7 @@ static nsresult NSAPI handle_load(nsIDOMEventListener *iface, nsIDOMEvent *event
     if(doc->basedoc.doc_obj && doc->basedoc.doc_obj->basedoc.doc_node == doc)
         doc_obj = doc->basedoc.doc_obj;
 
-    connect_scripts(doc->basedoc.window);
+    connect_scripts(doc->basedoc.window->base.inner_window);
 
     if(doc_obj)
         handle_docobj_load(doc_obj);
diff --git a/dlls/mshtml/script.c b/dlls/mshtml/script.c
index 84990e7c11a..099266eaab2 100644
--- a/dlls/mshtml/script.c
+++ b/dlls/mshtml/script.c
@@ -66,7 +66,7 @@ struct ScriptHost {
 
     SCRIPTSTATE script_state;
 
-    HTMLOuterWindow *window;
+    HTMLInnerWindow *window;
 
     GUID guid;
     struct list entry;
@@ -211,7 +211,7 @@ static void release_script_engine(ScriptHost *This)
     This->script_state = SCRIPTSTATE_UNINITIALIZED;
 }
 
-void connect_scripts(HTMLOuterWindow *window)
+void connect_scripts(HTMLInnerWindow *window)
 {
     ScriptHost *iter;
 
@@ -316,11 +316,11 @@ static HRESULT WINAPI ActiveScriptSite_GetItemInfo(IActiveScriptSite *iface, LPC
     if(strcmpW(pstrName, windowW))
         return DISP_E_MEMBERNOTFOUND;
 
-    if(!This->window)
+    if(!This->window || !This->window->base.outer_window)
         return E_FAIL;
 
     /* FIXME: Return proxy object */
-    *ppiunkItem = (IUnknown*)&This->window->base.IHTMLWindow2_iface;
+    *ppiunkItem = (IUnknown*)&This->window->base.outer_window->base.IHTMLWindow2_iface;
     IUnknown_AddRef(*ppiunkItem);
 
     return S_OK;
@@ -591,7 +591,7 @@ static const IServiceProviderVtbl ASServiceProviderVtbl = {
     ASServiceProvider_QueryService
 };
 
-static ScriptHost *create_script_host(HTMLOuterWindow *window, const GUID *guid)
+static ScriptHost *create_script_host(HTMLInnerWindow *window, const GUID *guid)
 {
     ScriptHost *ret;
     HRESULT hres;
@@ -796,7 +796,7 @@ static BOOL get_script_guid(nsIDOMHTMLScriptElement *nsscript, GUID *guid)
     return ret;
 }
 
-static ScriptHost *get_script_host(HTMLOuterWindow *window, const GUID *guid)
+static ScriptHost *get_script_host(HTMLInnerWindow *window, const GUID *guid)
 {
     ScriptHost *iter;
 
@@ -808,7 +808,7 @@ static ScriptHost *get_script_host(HTMLOuterWindow *window, const GUID *guid)
     return create_script_host(window, guid);
 }
 
-void doc_insert_script(HTMLOuterWindow *window, nsIDOMHTMLScriptElement *nsscript)
+void doc_insert_script(HTMLInnerWindow *window, nsIDOMHTMLScriptElement *nsscript)
 {
     ScriptHost *script_host;
     GUID guid;
@@ -818,7 +818,8 @@ void doc_insert_script(HTMLOuterWindow *window, nsIDOMHTMLScriptElement *nsscrip
         return;
     }
 
-    if(IsEqualGUID(&CLSID_JScript, &guid) && window->scriptmode != SCRIPTMODE_ACTIVESCRIPT) {
+    if(IsEqualGUID(&CLSID_JScript, &guid)
+       && (!window->base.outer_window || window->base.outer_window->scriptmode != SCRIPTMODE_ACTIVESCRIPT)) {
         TRACE("Ignoring JScript\n");
         return;
     }
@@ -831,7 +832,7 @@ void doc_insert_script(HTMLOuterWindow *window, nsIDOMHTMLScriptElement *nsscrip
         parse_script_elem(script_host, nsscript);
 }
 
-IDispatch *script_parse_event(HTMLOuterWindow *window, LPCWSTR text)
+IDispatch *script_parse_event(HTMLInnerWindow *window, LPCWSTR text)
 {
     ScriptHost *script_host;
     GUID guid = CLSID_JScript;
@@ -864,7 +865,8 @@ IDispatch *script_parse_event(HTMLOuterWindow *window, LPCWSTR text)
         ptr = text;
     }
 
-    if(IsEqualGUID(&CLSID_JScript, &guid) && window->scriptmode != SCRIPTMODE_ACTIVESCRIPT) {
+    if(IsEqualGUID(&CLSID_JScript, &guid)
+       && (!window->base.outer_window || window->base.outer_window->scriptmode != SCRIPTMODE_ACTIVESCRIPT)) {
         TRACE("Ignoring JScript\n");
         return NULL;
     }
@@ -885,7 +887,7 @@ IDispatch *script_parse_event(HTMLOuterWindow *window, LPCWSTR text)
     return disp;
 }
 
-HRESULT exec_script(HTMLOuterWindow *window, const WCHAR *code, const WCHAR *lang, VARIANT *ret)
+HRESULT exec_script(HTMLInnerWindow *window, const WCHAR *code, const WCHAR *lang, VARIANT *ret)
 {
     ScriptHost *script_host;
     EXCEPINFO ei;
@@ -936,7 +938,7 @@ IDispatch *get_script_disp(ScriptHost *script_host)
     return disp;
 }
 
-BOOL find_global_prop(HTMLOuterWindow *window, BSTR name, DWORD flags, ScriptHost **ret_host, DISPID *ret_id)
+BOOL find_global_prop(HTMLInnerWindow *window, BSTR name, DWORD flags, ScriptHost **ret_host, DISPID *ret_id)
 {
     IDispatchEx *dispex;
     IDispatch *disp;
@@ -1015,7 +1017,7 @@ void set_script_mode(HTMLOuterWindow *window, SCRIPTMODE mode)
         ERR("JavaScript setup failed: %08x\n", nsres);
 }
 
-void release_script_hosts(HTMLOuterWindow *window)
+void release_script_hosts(HTMLInnerWindow *window)
 {
     ScriptHost *iter;