Throwing an alert during the ondragenter event prevents the user from closing the dialog, effectively freezing the browser. As a side effect, the dragged text remains rendered on top of all other windows — not just the browser — until the user kills the process.

<textarea ondragenter="alert('Browser Frozen!\n\nMove to a different window to see how the dragged text goes over everything')"></textarea>

This is more of a nuisance-level issue than a security vulnerability. The dragged text floating above everything including the taskbar is an unusual visual side effect that makes the situation harder to recover from without Task Manager. Tested on IE10 / IE11 build 20130227-2100.

Found during my years at Microsoft (2006–2014). These bugs were patched long ago — shared here as a historical record for learning purposes.