Michal Zalewski has released some details with links to proof of concept code for a MSIE same-origin bypass race condition, MSIE memory corruption on page transitions, CANVAS implementation crashes, and Safari page transition tailgating.
aada75a86af557c06b7ae5af9b0eebe4b1e6812bafa534a00cb5dd004ecdf459