Internetworkers: http://www.ibiblio.org/internetworkers/

["Michael D. Thomas"<mdthomas AT mindspring.com>]

http://online.securityfocus.com/archive/1/267561

IE allows urls containing the javascript protocoll in the history list.Code 
injected
in the url will operate in the same 
zone/domain as the last url viewed. The
javascript url can be set to trigger when 
a user presses the backbutton.

The normal behaviour when a page fails to
load is to press the backbutton. The error
page shown by IE is operating in the local computer zone
(res://C:\WINNT\System3\shdoclc.dll/dnserror.htm# on Win2000). Thus, we can 
execute code and 
read local files.