...
I'm not sure what you mean by "hijack the IOleCommandTarget".
All we do is implementing client's IOleCommandTarget. It's
something different from document's one.
I understand that, but apparently the native implementation
(testing on the test bot WXPPROSP3) sends the command to the
client IOleCommandTarget instead of the document
IOleCommandTarget (at least under the conditions of the
webbrowser tests). That is what I mean by hijacking, the
command is going to the "wrong" target. My guess would be
that there is some sort of priority mechanism, though I have
no idea how it would work (except maybe "if there's a
client/container then send to that target, else send to the
document target).