Navigating an iframe’s location to a page with an X-Frame-Options header via script crashes IE.

<iframe></iframe>
<script>
    window[0].location = "xframe.aspx";
</script>

Found during my years at Microsoft (2006–2014). These bugs were patched long ago — shared here as a historical record for learning purposes.