A short one. While exploring what Flash’s getURL method would accept as a target, I found that embedding a url:file:/// scheme inside the redirect string caused IE8 to handle the navigation in an unexpected way.

<iframe src="redirector.swf?REDIR=url:file:///c:/" width="400" height="200"></iframe>

The Flash file simply issued a getURL call using whatever was passed in the query string. The question of fault attribution was genuinely unclear at the time — Flash was passing the URL along, but IE was the one acting on it. Worth noting that the bug was in the interaction between the two rather than in either component alone. Tested on IE8 8.0.6001.18405 with Flash 9.0.124.0.

Found during my years at Microsoft (2006–2014). These bugs were patched long ago — shared here as a historical record for learning purposes.