I haven't seen this exact issue posted here, but apologize if this has been replied to previously.
The company I work for uses the MS DHTML edit control as our primary editor in our software product. Since the release of this hotfix, we have only developed one solution, which is to remove the update, then try to coerce our customer's corporate IT people to hold off deploying it.
We did a little research with the DHTML edit control, and it would appear that many of the interfaces it exports return NULL pointers, specifically any interface which would return a reference to the DOM document. We access the object through the OCX, in a Delphi application, so perhaps there is a solution available to a C++ developer that we don't currently have available.
I know of a handful of other applications that are similarly broken, is there documentation available on a new method of using the control(s)? Is there a way to instantiate it that is 'safe' such that we can again access the DOM object? Running it in our application on the local machine doesn't seem like it should relate to 'cross site scripting' which is what was apparently resolved...