Microsoft Internet Explorer 6 SP2 and earlier allows remote attackers to cause a denial of service (crash) via certain malformed HTML possibly involving applet and base tags without required arguments which triggers a null pointer dereference in mshtml.dll.