The Outlook Express Address Book control when using Internet Explorer 6 allows remote attackers to cause a denial of service (NULL dereference and browser crash) by creating the OutlookExpress.AddressBook COM object which is not intended for use within Internet Explorer.