IE10 DoS: Calling document.open/close on Keypress in a Textarea Crashes Browser

Opening and closing the document from a textarea’s onkeypress event caused IE10 to crash on the first keystroke.

<textarea onkeypress="document.open();document.close();"></textarea>

The fault occurred in MSHTML!CMarkup::EnsureChangeNotificationContext during spell-checker initialization triggered by the key event.

Found during my years at Microsoft (2006–2014). These bugs were patched long ago — shared here as a historical record for learning purposes.