Originally developed in 2008, crashed every browser on the market back then:

http://lcamtuf.blogspot.com/2010/06/announcing-reffuzz-2yo-fuzzer.html 

The release of MS10-035 probably fixes the last of the known
exploitable issues it triggered.

/mz