Thanks! Has anyone contacted them regarding this bug?
I know I haven't. But Whoey may read this thread.
Technically it's not a bug, it's just a security feature in all modern browsers, but it is something that should be fixed server-side. My suggestion: force all traffic to the non-www URL. In that case, including the SAK Selector page in an iframe like it is now should work and it's also better from a SEO point of view. Because currently all content on swissarmyknights.com is available on at least 2 different URLs.
Alternatively the iframe source could just be the relative URL
/cgi-bin/sak_selector.cgi (so, no protocol, no domain name). That should work as well.