This entry is a variation of WinOOB 1053535, archived as a compressed proof-of-concept. The reproduction steps and source were preserved in the zip file rather than as standalone HTML. The core issue followed the same family of cached-object and out-of-bounds access patterns being explored during this period of IE8 pre-release testing.

Found during my years at Microsoft (2006–2014). These bugs were patched long ago — shared here as a historical record for learning purposes.