ecma/kjs_html.cpp in KDE JavaScript (KJS) as used in Konqueror in KDE 3.5.5 allows remote attackers to cause a denial of service (crash) by accessing the content of an iframe with an ftp:// URI in the src attribute probably due to a NULL pointer dereference.