You know, this isn't the first time I've heard of complaints about the coding in IE itself. OK, security bugs have been known, but the article (which unfortunately I can't find anymore) was from back in the day when IE integration was first being planned for the winNT code base.
What made this different, was that the complaints as I remember them were comming from the Windows NT development team itself, and as such Microsoft's own programmers. They cited problems with the code, general sloppiness, and aspects of the IE code base that simply weren't up to snuff for the NT code base; and then the task of having to integrate this sub-par code, in their view, into their own code base as things were moving into the release of win2k. As I remember, they were giving Balmer an ear full or something, and were being told to try to make it work, best they could...
Too bad I can't find indication of that currently via Google, as complaints about the general quality of the code, from Microsoft's own programmers (albeit from one of their OS dev teams) would make one hell of a point on the matter...