This one surprised me. Setting location inside onbeforeunload while the user simultaneously types a new URL in the address bar caused the entire browser window to close — and sometimes left an invisible iexplore.exe process running in the background.

<!DOCTYPE html>
<html xmlns="http://www.w3.org/1999/xhtml">
<head><title>OnBeforeUnload_Tab_Close</title>
</head>
<body>
<script language="JavaScript">
window.onbeforeunload = function()
{
	location = "http://www.dummy_site.com";
}
</script>
</body>
</html>

The race between the user’s address-bar navigation and the script-initiated navigation inside onbeforeunload left the browser in an unexpected state. In some cases the window closed cleanly; in others the process stayed alive but invisible. It was a good reminder that navigation events in IE could interact in surprising ways when both the user and a script tried to redirect at the same time.

Found during my years at Microsoft (2006–2014). These bugs were patched long ago — shared here as a historical record for learning purposes.