I thought the days of crashing IE with just some malformed code were over, apparently not. I just takes a misplaced wildcard in a style declaration to send it down.
<style>*{position:relative}</style><table><input /></table>
This took out IE on my work computer which is fully patched. I’ve read that people running IE under Wine in Linux have it crash as well, so it’s certainly app dependant. For those of you playing at home, just click here to try it for yourself. Extra credit if you actually save the file on your windows machine and then try to open it within Windows Explorer! Enjoy.