This is an intentional security decision in Caja. Certain functions that are prone (across the web) to serious malicious misuse, such as submit() and focus(), can only be executed while in the context of a user-initiated event (such as a button click).