mshtml.dll in Microsoft Internet Explorer 6.0.2800 allows remote attackers to cause a denial of service (crash) via a table containing a form that crosses multiple td elements and whose \float: left\ class is defined in a link to a CSS stylesheet after the end of the table which may trigger a null dereference.