Modifies the exploit a little for better stability

Without this patch, it looks like the 1st attempt tends to fail first, but then IE recovers from the crash, and then that's how we get a shell.

This patch makes sure the LFH is enabled before the CGenericElement object is created.  Trigger is also modified a little.  Seems better.

Tested on XP SP3 + IE 8 and Win 7 + IE8