[PATCH] mshtml: Fix out-of-bounds props access.