This bug only reproduced on the Win7 IE10 build at the time (20120723-2300), not on Win8 RP. The history.replaceState API had trouble keeping the address bar in sync: after replacing the current URL with a redirect target and then reloading, the page would navigate to the redirected site (Bing in this case) while the address bar remained frozen on the original URL.

function main() {
    history.replaceState("", "", "redir.aspx");
    location.reload(); // Loads bing.com but the address bar does not get refreshed.
}

The redirect is only there to demonstrate the cross-domain aspect — the real problem is that location.reload() after replaceState leaves the address bar out of step with the actual page content. Tested on Win7 IE10 build 20120723-2300.

Found during my years at Microsoft (2006–2014). These bugs were patched long ago — shared here as a historical record for learning purposes.