Not so much busting out of the parent, as getting it all flustered by hijacking its key events.
Can you type anything in this here textarea?
This is the same-domain version. cross-domain version
For the curious, I discovered this is possible when I embedded RumpetRoll in an HTML5 presentation.
On some browsers, you can use the new "sandbox" attribute to prevent JavaScript running in the child.