I came across a nice juicy bug in Internet Explorer today. New to me, but not to everyone else.
The short version is, if you change the useMap property of an img node then when the new map has fewer area nodes than the old one, IE will crash.
The good news is that it seems to be fixed in IE 8 beta 2. So we can stop worrying about this bug in ten years or so time…