rapid7/metasploit-framework — pull request #1919 by wchen-r7 (2013-06-07 05:31:28+00:00)
Title: Updates js_property_spray documentation

After many tests, it turns out address 0x0c0d2020 is the most consistent location acorss various IE versions. For dev purposes, it's rather important to have this documented somewhere.

Thanks to corelanc0d3r for the data.