1. Go here: http://yoni.valhallalegends.com/stuff/iecrash.html (http://yoni.valhallalegends.com/stuff/iecrash.html)
(Simply visiting the page won't cause a crash - so you can view the source.)
2. Click the "Click here to crash!" link (the link might not act very linkishly, but it's a link).
I got this one off ntbugtraq (http://www.ntbugtraq.com). According to them, these will be fixed in the next IE service pack, SP2.
Lynx > IE :o