I have tested the following on two separate iPhones and it caused crashes on them both. I don’t have an iPhone of my own to test with, so I’m not able to investigate this much further.

Create a blank file named anything.txt and then upload it to some webspace. It needs to be completely blank… 0 bytes. It must be served as text/plain. At least, “text/plain” is the only content type I know for sure it works with as I didn’t try any others. Send an HTML email to an email account that the iPhone can access. The HTML email must contain a meta refresh tag to the file which you have just created. Example:

< head > < meta http-equiv = "Refresh" content = "1; URL=http://EXAMPLE/anything.txt" > </ head >

3.) Open the email on an iPhone. The iPhone email client actually honours the meta refresh and attempts to load the URL. It then proceeds to crash. Next time you open the email client it will have to re-sync all of the email.

This information comes with no warranty. Use it only for good, and only on your own phone.

Update:

This bug has actually been reported to Apple. Although they still haven’t fixed this bug on the iPhone which I reported to them back in October, so god only knows how long it will take them to fix this one.