Executing Arbitrary Commands Without Active Scripting or ActiveX
Advisory by GreyMagic Security explains how a vulnerability in elements can be exploited with data binding.

No queries for www.greymagic.com/security/advisories/gm001-ie