А у интерфейса IHTMLWindow2 есть такой метод execScript. IHTMLWindow2 можно получить у IHTMLDocument2 вызовом get_parentWindow.

MSDN:
/////////
HRESULT execScript(
BSTR code,
BSTR language,
VARIANT *pvarRet
);

code — String (BSTR) that specifies the script code to execute.

language — String (BSTR) that specifies the language in which the code is executed. The default is Microsoft® JScript® (compatible with ECMA 262 language specification).

pvarRet — Address of a VARIANT structure that receives the return value from the script code.

///////////
HRESULT get_parentWindow(
IHTMLWindow2 **p
);