I'm sorry but what are saying simply appears to be wrong.
I just now added these lines to my defaults/pref/security-prefs.js file:
user_pref("capability.policy.default.Window.open", "noAccess");
user_pref("capability.policy.default.Window.moveTo", "noAccess");
user_pref("capability.policy.default.Window.resizeTo", "noAccess");
user_pref("capability.policy.non_spammers.sites", "http://www.mozilla.org");
user_pref("capability.policy.non_spammers.Window.open", "sameOrigin");
I quit Mozilla completely are restarted and then went back to:
http://www.wpi.edu/~dpotter/infinite.html
And sure enough it was popping up windows.
Both you and the documentation can say that something is a certain way but the fact is
that he
program is simply not doing it that way. Why don't you try it for yourself?