I can confirm that the PoC _does_ crash Chrome 0.2.149.29 Build 1798 running on XP SP2. Perhaps it's the build? -- Razi