IEのクラッシュ

Details
=======
Pointing a link to the URI -> file://!:\ [replace ! with the character with ascii value for eg:- 0xA0]. Causes IE6-SP1 to crash, the illegal op occuring in user32.dll. Other special characters are also possible.

Demo
====
A demonstration is available at the following URL.
http://crapware.lx.ro/junkcode/security/ie-sp1-file-a0-crash.htm

bugtraq ML より。
こういうのは分かり易くて良いですね。