The third crash from 2010-05-17 was the simplest of the batch. An HTML file containing only a bare <svg> tag with the XML namespace declaration was enough to crash the IE9 beta.

<svg xmlns>

No script, no content — just the tag. The SVG parser in the IE9 beta did not handle the minimal namespace declaration gracefully, and the resulting parse state caused an access violation. This type of minimal reproducer is often the most useful for triage because it isolates the failing code path cleanly.

Found during my years at Microsoft (2006–2014). These bugs were patched long ago — shared here as a historical record for learning purposes.