Internet Explorer 6 on Windows XP SP2 when Outlook is installed allows remote attackers to cause a denial of service (crash) by calling the NewDefaultItem function of an OVCtl (OVCtl.OVCtl.1) ActiveX object which triggers a null dereference.