We have recently had a similar problem on the machines of several customers. The problem turned out to be a bug in the MSHTML control in certain environments. A common symptom for the problem seems to be the broken registration of the jscript.dll library.
Symptoms that may help to diagnose if it’s the same problem – the jscript.dll is not listed in Modules in the debugger and is not loaded by the process; Native stack trace for the crash is the following:
mshtml!CRootTracker::CollectGarbageInternal+0xd
mshtml!CDoc::ReduceMemoryPressureTask+0x29
mshtml!CStackPtrAry<unsigned long,12>::GetStackSize+0xb6
mshtml!GlobalWndProc+0x183
USER32!InternalCallWinProc+0x23
USER32!UserCallWinProcCheckWow+0x109
USER32!DispatchMessageWorker+0x3bc
USER32!DispatchMessageW+0xf
The solution is to re-register the jscript.dll library and the crash should go away.
Re-registering the library is done as follows (example given for 64-bit Windows, otherwise only the first line is necessary):
C:\Windows\System32\regsvr32.exe C:\Windows\System32\jscript.dll
C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\jscript.dll
Both commands have to be “Run as Administrator”.