Yikes, that's a nasty one. Sad MSFT didn't want to pay bounty on this.