Internet Explorer 6.0 on Windows XP SP2 allows remote attackers to execute arbitrary code by using the \Related Topics\ command in the Help ActiveX Control (hhctrl.ocx) to open a Help popup window containing the PCHealth tools.htm file in the local zone and injecting Javascript to be executed as demonstrated using \writehta.txt\ and the ADODB recordset which saves a .HTA file to the local system aka the \HTML Help ActiveX control Cross Domain Vulnerability.\