Gotta love IE...
 

Lovely little IE fuck up...
CODE

this will crash IE 6+

edit: look a few posts down for the HTML which will crash IE

I'm running IE 6 and all i see it a blank text entry box...

i'd like to see this work though it would be a great prank, set that as someones homepage and presto!

Not sure what code is in your box, but these 5 lines will crash IE6.
I left off the <'s and you can basically replace the word 'crash' with any unrecognized word.

html>
form>
input type crash>
/form>
/html>

Man, you weren't kidding. Took my work comp a few minutes to choke through the errors. My comp science teachers are always telling me to expect bad input from users, guess nobody up in redmond heard that advise before, ;) .

Heh, combine this with the CD-drive open file and you get a CD-Opening, IE-Crashing home page... beginning carets removed of course...

Of course, replace the (PUTAOPENCARETHERE) and (PUTACLOSECARETTHERE) appropriately...

Or, to download this little bugger or see it live:
click here, or right click there and hit save target as to save.

now now, it's not there fault they use what's default. And no warning == bad mojo.

hmm i tried the link on my ie gamer, didn't do anything cept pop out the cd and show a text box, which i entered text into
ie6 2800 sp2 xp, no crashes.

charlie, link's fixed now. 50megs was messing it up, had to move it to brinkster. please note that it won't close IE altogether, just the window it's trying to open in...

it only works(that ive seen) on IE6.0+

yep, that err fixed it , crashed alright.

buqtraq info. just for the heck of it ->

IE tries to compare the type of the input field to "HIDDEN", to see if it
should be rendered. When there is no type string, a null-pointer is used.

mshtml.dll calls shlwapi.dll#158 @ 0x636f0037 with a pointer to a static
unicode string "HIDDEN" and a null-pointer.
shlwapi.dll#158 does a case-insensitive comparison of two unicode strings:
it reads from address 0x0 because of the null-pointer and thus causes an
exception.
This is not exploitable, other then a DoS because there is no memory mapped
@ 0x0 and even if you could load something there, you could only compare it
to "HIDDEN" which gets you nowhere.

Berend-Jan Wever
----

luckily you can just exit out of that function with a debugger ;)