Using the W3Schools DTD Validator example that can only work in IE, I started playing with this Microsoft XMLDOM object to see if it is vulnerable. I created the following test case to manipulate the $target$ value and validate it to see the results. You can see this JS in action via this link in IE: http://jsfiddle.net/ubqug/2/ you can even use the same technique to detect available files on the C drive. The result was promising as I received Unspecified error for the file that was available on my file system.”]