I found same-origin policy potential issue on stringByEvaluatingJavaScriptFromString method of UIWebView. When you use this method at shouldStartLoadWithRequest with http redirect, javascript will be executed on wrong domain.
more here.........http://harupuxa.blogspot.jp/2014/10/same-origin-policy-potential-issue-of.html
more here.........http://harupuxa.blogspot.jp/2014/10/same-origin-policy-potential-issue-of.html