A deadcall crash using DOM Range objects: creating a range from an IFrame, reloading the IFrame, and then calling cloneRange() from a live range on behalf of the dead one caused a crash in MSHTML!CDocument::Doc.

var badRange = iFrame.document.createRange();
iFrame.location.reload();

setTimeout(function() {
    document.createRange().cloneRange.call(badRange); // Crash
});

The DOMParser.parseFromString combination produced the same crash. These entries were filed as part of a broader deadcall fuzzing effort — the common thread was using Function.call to call a method with a destroyed object as this, which bypassed the lifetime validation that would normally prevent such calls.

Found during my years at Microsoft (2006–2014). These bugs were patched long ago — shared here as a historical record for learning purposes.