Selenium1.0时代就是用javascript实现的，应该用了类似手段。

<html>
	<head>
		<title>
			发送模拟按键
		</title>
	</head>
	<body>
		<div id="mydiv">点击按钮向文字框发送模拟按键（仅对firefox有效）
		<textarea id="myTextbox" name="yes"></textarea>
		</div>

		<form name="myform" method="get">	
			<input type="button" id="mybtn" value="click me">
		</form>
		
		<script type="text/javascript">
			var btn=document.getElementById("mydiv");
			var btn=document.getElementById("mybtn");
			var textbox=document.getElementById("myTextbox");
			var evt;
			if(document.implementation.hasFeature("KeyboardEvents","3.0")){
				evt=document.createEvent("KeyEvents");
			}

			mydiv.οnclick=function(){
				textbox.value="";
			}

			textbox.οnkeydοwn=function(event){
				textbox.value=textbox.value+String.fromCharCode(evt.which);
			}

			btn.οnclick=function(){
				evt.initKeyEvent("keydown",false,true,document.defaultView,false,false,false,false,97,97);
				textbox.dispatchEvent(evt);
	
				evt.initKeyEvent("keydown",false,true,document.defaultView,false,false,false,false,100,100);
				textbox.dispatchEvent(evt);

				evt.initKeyEvent("keydown",false,true,document.defaultView,false,false,false,false,109,109);
				textbox.dispatchEvent(evt);

				evt.initKeyEvent("keydown",false,true,document.defaultView,false,false,false,false,105,105);
				textbox.dispatchEvent(evt);

				evt.initKeyEvent("keydown",false,true,document.defaultView,false,false,false,false,110,110);
				textbox.dispatchEvent(evt);
			}
		</script>
	</body>
</html>