I found the solution. Not only can you call the HTML5 postMessage() API to pass messages back and form from/to the IFRAME to the parent document, but Qt's version of WebKit have lax security controls compared to Chrome and do allow you to do the following in the IFRAME's Javascript. The trick is the window.parent.[whatever] -- something that Chrome won't let you do with stuff accessed with file:// (local files).
$(document).ready(function(){
if (window.parent.cpp) {
var cpp = window.parent.cpp;
// do something with C++ here through the cpp object
}
});