WebKit in Apple Mac OS X 10.3.9 10.4.9 and later and iPhone before 1.0.1 performs an \invalid type conversion\ which allows remote attackers to execute arbitrary code via unspecified frame sets that trigger memory corruption.