Microsoft Internet Explorer 5.0 through 6.0 allows attackers to cause a denial of service (browser crash) via a crafted FTP URL such as "/.#./".
https://exchange.xforce.ibmcloud.com/vulnerabilities/10117
https://euvd.enisa.europa.eu/vulnerability/EUVD-2001-1430
http://www.kb.cert.org/vuls/id/199408
http://cert.uni-stuttgart.de/archive/vuln-dev/2001/05/msg00029.html