IE9 Crash: Window Method Cached Inside a Native JScript Object

Storing a window method as an element inside a native JScript Array object, then reloading the IFrame that owned the window, and finally calling the cached method through the array caused a crash in IE9.

arrCachedMethod = wIFrame.Array(wIFrame.open);
wIFrame.location.reload();
arrCachedMethod[0](); // Crash

The Array constructor was called on the IFrame’s window to create a native array in the IFrame’s script context. After the reload, the underlying script engine for that context was torn down, but the JavaScript object wrapper in the parent page still held the method reference. Invoking it through the array tried to dispatch into the destroyed script context, causing an access violation.

Found during my years at Microsoft (2006–2014). These bugs were patched long ago — shared here as a historical record for learning purposes.