using runtime html4,"Security Error" with HTML4 runtime

Why there shouldn't be a cross-domain case involved when you load your resources from another domain (sub-domain is still considered another domain)..? Do the domains of the page with Plupload and that of upload url differ or no?

html5, flash, silverlight do support CORS, although they require some pre-requisites, html4 throws security error, so there's no way to check if file upload went successfully or not.

What would be a correct moment to do domain relaxing in our case you think? html4 uses hidden iframe to upload files.