In this case, I can tell from the call stack that it is calling http://msdn.microsoft.com/en-us/library/ms762722%28v=vs.85%29.aspx http://msdn.microsoft.com/en-

In this case, I can tell from the call stack that it is calling http://msdn.microsoft.com/en-us/library/ms762722%28v=vs.85%29.aspx http://msdn.microsoft.com/en-us/library/ms762722%28v=vs.85%2... with a res:// URL. One solution would be to load the resource manually using Win32 APIs, convert to BSTR, and then calling http://msdn.microsoft.com/en-us/library/ms754585%28v=vs.85%29.aspx http://msdn.microsoft.com/en-us/library/ms754585%28v=vs.85%2... instead. And yes don’t forget to disable loading of external entities too.