Launchpad.net

CVE 2005-3896

Mozilla allows remote attackers to cause a denial of service (CPU consumption) via a Javascript BODY onload event that calls the window function.

See the CVE page on Mitre.org for more details.