Very broadly, this is how the bug is triggered.
- The HTML file is being parsed.
- Script is executing.
- The script attempts to add, or remove an element from an unclosed non-parent DOM element.
IE8 b1 now has sort of fixed this, by converting this from a complete runtime crash to a (non-modal) exception.