Combining an AppCache manifest with a fallback entry and a meta-refresh tag caused IE10 to crash after a few reloads.

# manifest.appcache
FALLBACK:
404_image_not_found.gif fallback.gif
<!doctype html>
<html manifest="manifest.appcache">
<head>
<meta http-equiv="refresh" content="0" />
</head>
<body>
<img src="404_image_not_found.gif" />
</body>
</html>

The fault occurred in MSHTML!CDwnLoad::RequestProgress while processing the AppCache fallback during a reload cycle.

Found during my years at Microsoft (2006–2014). These bugs were patched long ago — shared here as a historical record for learning purposes.