I could be wrong, but with the information presented here, I don't see
this as a big security flaw. There are already plenty of ways to do
pop-ups, or to DoS a box by doing tons of pop-ups that consume
resources.
It may not be a "big security flaw" but it is yet another way that a
Microsoft application is being exploited yet again. I knew I was right to
get rid of IE.
