FYI: I've checked in a fix for this work item as change 15319 to the Development branch for inclusion with the next Toolkit release. Change comments:
"Avoid IE6 insecure content warning when accessing PopupBehavior-using controls (ex: DropDown, HoverMenu, PopupControl, ValidatorCallout) over an HTTPS connection. Instead of pointing the created IFRAME's src property at "about:blank", set it to "javascript:document.open();document.write('<html></html>');document.close();" instead. This has the same effect (of opening an empty page) and avoids the need for a round-trip to the server to fetch a blank page from the Toolkit's resource section."
You should be able to make the same change to your source code in order to try this out early. Please let us know if you encounter any problems with it!