It's possible to hang Outlooks Express by using prn: device as a name for bgsound or iframe. It's also possible to send data to special device.
vulners.com/securityvulns/securityvulns:doc:2837