Maybe I need it someday, so leave a message here.
SUMMARY
This article shows how to get the IHTMLDocument2 interface from a HWND. If Microsoft Active Accessibility (MSAA) is installed, you can send the WM_HTML_GETOBJECT message to the document’s window (with the window class “Internet Explorer_Server”) and then pass the result from SendMessage to an MSAA function, ObjectFromLresult, to get a fully marshaled IHTMLDocument2 pointer.
Here is VB version
Here is C version