An <audio> tag with the autoplay attribute inserted via insertAdjacentHTML continued playing audio even after the page navigated away. The audio element was not torn down with the rest of the document, leaving it alive as a “zombie” in memory.

document.body.insertAdjacentHTML(
    'beforeEnd',
    '<audio autoplay="autoplay" src="music.mp3"></audio>'
);
// Navigate the page — audio keeps playing
location.href = "http://www.google.com";

This was more of a nuisance than a security issue, but it demonstrated that the media pipeline in IE9’s early beta did not properly hook into the document lifecycle. A malicious page could use this to keep audio playing across navigations — potentially disorienting or harassing a user who could not find the source of the sound.

Found during my years at Microsoft (2006–2014). These bugs were patched long ago — shared here as a historical record for learning purposes.