Repeatedly calling document.write(1) on a freshly created popup via setInterval caused IE9 to crash. The first call worked; the interval kept creating new popups and writing to them, eventually hitting a state where the popup’s document was not in a writable condition.
createPopup().document.write(1);
setInterval("createPopup().document.write(1);", 1000);
Each iteration created a new popup document, opened it implicitly, wrote to it, but did not explicitly close it. After several cycles the browser’s internal document management reached an inconsistent state and crashed. The fix likely involved ensuring the implicit open/close lifecycle of popup documents was correctly managed under interval-driven creation.
Found during my years at Microsoft (2006–2014). These bugs were patched long ago — shared here as a historical record for learning purposes.