Calling document.normalize() on a complex DOM in IE10 Preview 4 caused a crash. The crash was found while a W3C spec page loaded and called the method as part of its own script.

document.normalize(); // Crash!

The fault occurred in mshtml!CTreePosGap::PartitionPointers during tree normalization, triggered via CDocument::normalize in the DOM implementation.

Found during my years at Microsoft (2006–2014). These bugs were patched long ago — shared here as a historical record for learning purposes.