This was a lucky strike — the crash stumbled upon me while I was testing something else entirely. Dragging text out of an <input> or <textarea> element inside an XML file caused IE10 Preview 2 to crash immediately.

<!-- xml.xml -->
<html:input type="text" value="Drag and drop me anywhere to crash the browser" />

The fault landed in MSHTML!CElement::GetClientOrigin during the drag-drop setup path. The crash did not require any scripting — just loading the XML file and attempting a drag operation was enough to trigger it.

Found during my years at Microsoft (2006–2014). These bugs were patched long ago — shared here as a historical record for learning purposes.