The JIT compiler in Microsoft .NET Framework 3.5 Gold and SP1 3.5.1 and 4.0 when IsJITOptimizerDisabled is false does not properly handle expressions related to null strings which allows context-dependent attackers to bypass intended access restrictions and consequently execute arbitrary code in opportunistic circumstances by leveraging a crafted application as demonstrated by (1) a crafted XAML browser application (aka XBAP) (2) a crafted ASP.NET application or (3) a crafted .NET Framework application aka \.NET Framework JIT Optimization Vulnerability.\