A demo can be found here: http://schinken.github.io/experiments/iecrash/crash.html

A combination of a filter-gradient and text-transform specified on a :filter-letter pseudo selector crashes the IE8/9 reproducable