[Bug 4708] Regression (urlmon): IE6 setup crashes