[Bug 48762] New: IExplore immediately crashes on www.msnbc.com

[WineHQ Bugzilla]

https://bugs.winehq.org/show_bug.cgi?id=48762

Bug ID: 48762
           Summary: IExplore immediately crashes on www.msnbc.com
           Product: Wine
           Version: unspecified
          Hardware: x86
               URL: http://www.msnbc.com
                OS: Linux
            Status: UNCONFIRMED
          Severity: normal
          Priority: P2
         Component: jscript
          Assignee: [e-mail]
          Reporter: [e-mail]
      Distribution: ---

On wine's iexplore.exe, while trying to load www.msnbc.com, the browser
crashes.
The last line on the console:

Assertion failed: jsdisp->builtin_info->class != JSCLASS_NONE, file object.c,
line 83

I tracked down the part of the site that leads to the crash, and reduced it to

<meta http-equiv="x-ua-compatible" content="ie=edge">
<script>{}.toString.call(Object.create(Number.prototype))</script>