This is @norio_nomura's hack, this is his great work.
In fact, WebView passes "webView:createWebViewWithRequest:" method to UIWebViewWebViewDelegate before the new window opening. It is called for deciding which webview will be used as view to open a next URL. However UIWebView's UIWebViewWebViewDelegate returns nil for "webView:createWebViewWithRequest:" because it isn't implemented, default.
Therefore, to avoid target="_blank" problem, we should implement this method into "
UIWebViewWebViewDelegate" class with dynamic programming style. So, following code.

static id webViewcreateWebViewWithRequestIMP(id self, SEL _cmd, id sender, id request) {
return [sender retain];
}
+ (void)installNewWindowDelegateHook {
Class klass = objc_getClass( "UIWebViewWebViewDelegate" );
if( klass == nil )
return;  // unfortunately, UIWebViewWebViewDelegate has gone...
class_addMethod( klass,
@selector(webView:createWebViewWithRequest:),
(IMP)webViewcreateWebViewWithRequestIMP,
"@@:@@" );
}

Already done!
Thank you, @norio_nomura.