The SfnLOGONNOTIFY function in win32k.sys in the kernel in Microsoft Windows 2000, XP, and Server 2003 allows local users to cause a denial of service (system crash) via a 0x4c value in the second argument (aka the Msg argument) of a PostMessage function call for the DDEMLEvent window.
https://euvd.enisa.europa.eu/vulnerability/EUVD-2010-1755
http://www.securityfocus.com/bid/39630
http://www.securityfocus.com/archive/1/510884/100/0/threaded
http://vigilance.fr/vulnerability/Windows-denials-of-service-of-win32k-sys-9607