Opening a modeless dialog and then accessing the onmessage property of the opener window from within the dialog’s script context caused a crash in IE9.

win = showModelessDialog("dummy.html", window);
win.execScript("dialogArguments.onmessage"); // Crash

The dialogArguments object exposed the opener window to the modeless dialog’s script. Accessing onmessage on that window reference triggered an access violation, suggesting the property accessor had not been properly guarded against the cross-context call originating from a modeless dialog.

Found during my years at Microsoft (2006–2014). These bugs were patched long ago — shared here as a historical record for learning purposes.