Posted by Gil Besso on Mar 09

Not exactly what you’re after, but might interest you anyway:
http://scarybeastsecurity.blogspot.co.il/2011/03/multi-browser-heap-address-leak-in-xslt.html