Georgi Guninski security advisory #8 - There is a vulnerability in IE 5.x for Win95/WinNT (probably others) which allows executing arbitrary programs using .chm files. Microsoft Networking must be installed. Demonstration which starts wordpad here.
36cf5adf9fed04673b3b5f1b78c820e4d91c6d87aaadd7695c5310bb6022635e