I'm not that familiar with BeEF, but it is possible to set the location on child iframes, just not get it.

It also looks like BeEF is running on your local machine, so they could presumably do whatever they want to bypass the browser's security model.