If I'm remembering correctly, Microsoft later changed it from trying to "sanitize" the suspicious content to just flat refusing to render the page when it detec

If I'm remembering correctly, Microsoft later changed it from trying to "sanitize" the suspicious content to just flat refusing to render the page when it detects reflected content. I'm interested in pros/cons of the reflection-detecting vs. taint-tracking approaches, not about different approaches to actions taken post-detection (which is where the initial IE8 approach fell over).