I made a simple web page as outlined at the [link|http://www.securityfocus.com/archive/1/319360/2003-04-20/2003-04-26/0|Security Focus] link. The page is:

<html>
<form>
<input type crash>
</form>
</html>


(Note that it gives a null-pointer exception in everything that uses SHLWAPI.DLL (IE, Frontpage, etc.).)

Opening the page with IE gives a Norton AntiVirus Notification popup:

Scan type: Realtime Protection Scan
Event: Virus Found!
Virus name: Trojan.CrashIE
[...]


Turning off NAV gives a blank page with no crash, so apparently that bug has been fixed in one of the post 2003 IE updates.

FWIW.

Cheers,
Scott.