Pointing a link to the URI file://!:, replacing ! with the ascii value 0xA0, causes IE6 under SP1 to crash, the illegal op occuring in user32.dll.
You can download this advisory from the following link: https://packetstormsecurity.com/files/download/36189/ie-sp1-crash.txt
Source: https://packetstormsecurity.com/files/36189/ie-sp1-crash.txt.html