Even worse, if you send someone an HTML mail (i.e. a mail with a MIME content type of text/html, rather than an HTML page attachment) then when OE tries to view it it'll lock up, and if no new mail has arrived when you restart it then it'll automatically lock up as it tries to view it again. Even if new mail does arrive then you'll still have problems since the nasty mail can't be handled (moved or deleted) without OE trying to preview it first, so it's stuck. However, most of these problems don't apply if the preview pane is switched off. (View menu/Layout)
(Post-final addendum: OE will now give an error message on restart and not display the message it was displaying, if it crashes rather than getting shut down properly)
To send someone a mail with this thing in, you have to either turn off JScript (in Options/Security/Custom) and use Send Page or just send it from Netscape (which lets you insert arbitrary HTML into your mail, unlike OE).
I haven't tried setting this page as an Active Desktop component, but I would assume that this is probably the most guaranteed way of buggering up a machine running IE4 (especially if the page is stored locally), since the Win95/IE Shell will lock up as soon as it finishes starting up, and Safe Mode (or making a dash for the Desktop context menu during startup) will be needed to turn it off.
-- Yoz
P.S. This bug has just been reported on BUGTRAQ and news.com, only a year after I found and reported it in the first public beta...
P.P.S. Yes, I know I'm a smartarse. But, hey, it's a dull day.