Tested on XP SP3 EN on VBox with IE 7
Spraying a lot to get a nice unicode usable address 0x20260078
I sprayed with a set of P/P/R instructions to come back to the stack
***Need internet connection on the box to trigger the vuln***
Wait for the Spray to finish (IE will seem freezed for some seconds)
The Sopcast control will be loaded and shown on the page
wait approx 3 to 5 seconds and a message box should appear