The relationship between 'window' objects and Object.prototype must be different now in IE9.
I've attached a file which shows how a Function object gets placed on Object.prototype, and is actually alerted when the page first loads. But when the button is clicked to 'run the test' and the same property is (re)defined on the 'window' object, the entire browser crashes before the alert() in the runTest() function.
Note that this *only* occurs if the IE9 Preview is in IE9 mode. I've placed a <meta> tag at the top to ensure that it is.