Found this one just about now... I hope it ain't posted before...
Article can found hereInternet explorer can be crashed by clicking on a specially crafted link . The problem is in the AnchorClick DHTML behaviour of the A ( link ) object . With this behaviour you can specify a Folder instead of using the href attribute .
***edit*** You can find lots more security - news here :