Mozilla allows remote attackers to cause a denial of service (application crash from invalid memory access) via an \unusual combination of visual elements \ including several large MARQUEE tags with large height parameters as demonstrated by mangleme.