From HD's blog post, here's a link to the original disclosed exploit:<p><a href="http://wepawet.iseclab.org/view.php?hash=1aea206aa64ebeabb07237f1e2230d0f&#38;type=js" rel="nofollow">http://wepawet.iseclab.org/view.php?hash=1aea206aa64ebeabb07...</a><p>DEP stops it on IE7 and IE8.<p>It looks like use-after-free; an event is created for a DOM object, stored, the DOM object is cleared, and the DOM object is referenced through the event object from a second event.