There have been tricks that get popups through, possibly by exploiting browser bugs or opening the popup in one of the few on* handlers where browsers allow them.