The closest thing that matches your question is a Clickjacking attack (UI redress).
This is where you load another website within an IFrame that contains a button for the user to click. For example you (the attacker) could load the URL on a user's bank's website in the form
12345 is your account number. If they are already logged into their bank and the response is a HTML form containing a single
Transfer button, you could draw your own UI in your outer page that would replace the button with one that said
Get a free iPad now!.
When the unsuspecting user clicks the free iPad button on your site, they are in fact clicking the Transfer button on their bank's website to transfer the money.
This sort of attack can be defeated by setting the
X-Frame-Options HTTP header which modern browsers will obey and stop your website from being loaded within a frame.
Accessing the loaded IFrame using scripting is prohibited due to the Same Origin Policy - the only way round this if the user is using some old unsupported browser, or a browser containing a vulnerability where the origin is not properly checked.
The other possibility is a Rebinding Attack - the scope of this is usually limited as the cookies sent to the rebound IP will be the same as to the attacker's domain.