Anyone know if this can be done by somehow overriding the window.open function? or maybe air.HTMLLoader.createRootWindow function?
Obviously in the override I would have to capture the urlrequest and put it in the iframe src.
One approach would be overriding window.open. However, this can only be done in ActionScript since it requires extending a class. There's an example in the AIR Developer's guide (which I see you have commented on already). Your situation is a bit more complicated than the examples in the docs because you are loading remote content into an iframe. You might have to experiment to figure out if the HTMLHost location() functions are called when a link in an iframe is followed. (I don't know.) If so, you could try passing a reference to the iframe object to your HTMLHost class when you create it and use that reference to load the URL given to you by the location() function's locationURL argument into the correct place.
Another tactic would be to walk the DOM of the iframe and rewrite the link objects so that they open in the same window.
Still another would be to intercept an appropriate event on the iframe object and prevent the default behavior so that you can force the link to load in the desired iframe.
(Using air.HTMLLoader.createRootWindow wouldn't help here as it creates an entirely new window.)