A test case that looked interesting at first, but most likely it is only a null ptr. Anyway you can find the proof of concept below.
It was tested on Windows 7 and 8.1, doesnt crash on older versions of IE as the faulty code was introduced in IE11.