Changed core and component code generating iframes dynamically to use pseudo URLs, this actually simplified alos the code since the URLs don't have to be resolved anymore.
Introduced 'com.icesoft.faces.disableBrowserHistoryTracking' parameter to allow the disabling of back button detection, this also avoids having the history iframe from requesting pages from the server.

To avoid having the history iframe pointing '.....xmlhttp/blank' URL the following context parameter needs to be added to web.xml file:

<context-param>
<param-name>com.icesoft.faces.disableBrowserHistoryTracking</param-name>
<param-value>true</param-value>
</context-param>

When the history tracking is disabled the client (bridge) will not detect when the back button is used. So navigating back will bring up the page corresponding to the previous URL but with the content that the page had when loaded. Any content change that the previous page suffered due to any AJAX or push interaction is not restored.
When history tracking is enabled and the back button is pressed the client (bridge) will fetch automatically the current content corresponding to the previous URL and apply that to the page.

This needs to be tested using IE6 with HTTPS configured as well.

It seems I've done the test in the past: http://jira.icefaces.org/browse/ICE-5123?focusedCommentId=27421&page=com.atlassian.jira.plugin.system.issuetabpanels%3Acomment-tabpanel#action_27421