IE7 flaw clarified