Thanks for the heads up! This was actually something we developed a fix for version 5.5 (released earlier today). The iframe now points to a blank page generated by the SlickUpload handler. src="about:blank" actually doesn't work in all scenarios (note the update at the bottom of the post), specifically those with https pages.
We are also researching the javascript src solution mentioned lower down in the comments section of that page, and will move to that if it satisfies our compatibility matrix.
