A.com opens a B.com#:~: window. This should not scroll to the text fragment.
Without exploit!

A.com navigates itself to B.com#:~: and simultaneously opens a new A.com window which can access this window until the navigation to B.com commits. This should not scroll to the text fragment.
With exploit!