Accessing the bgColor property of a freshly created htmlFile ActiveX crashes IE. However, if any property on the ActiveX’s parentWindow is set first — even a completely arbitrary one — the crash doesn’t occur. A strange one-line fix that revealed an uninitialized state in the htmlFile object.
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD><TITLE>htmlFile Crash</TITLE></HEAD>
<BODY>
<INPUT TYPE="BUTTON" ONCLICK="alert(axHtml_01.bgColor)" VALUE="Get the bgColor property of the htmlFile ActiveX (Crash)"><BR><BR>
<INPUT TYPE="BUTTON" ONCLICK="axHtml_02.parentWindow.Anything=1;alert(axHtml_02.bgColor)" VALUE="Set anything to the ActiveX and get the bgColor property of the htmlFile ActiveX (NO Crash)">
<SCRIPT LANGUAGE="JavaScript">
var axHtml_01=new ActiveXObject("htmlFile");
var axHtml_02=new ActiveXObject("htmlFile");
</SCRIPT>
</BODY>
</HTML>The htmlFile ActiveX creates a document object but doesn’t fully initialize its scripting context until something touches the parentWindow. Accessing bgColor before that happens dereferences an uninitialized pointer. Setting any value on parentWindow (even Anything=1) completes the initialization and makes subsequent property reads safe.
Found during my years at Microsoft (2006–2014). These bugs were patched long ago — shared here as a historical record for learning purposes.