Can you please give us the steps to repro this issue?

When I open a new tab, either by clicking New Tab or by clicking an external link 
that opens one, about 50% of the time I get an error message that Internet Explorer 
has stopped working.

Actually, my description above may be incorrect. That depends on whether or not IE 
opens the Home Page when an external link is clicked and IE is set to open the Home 
Page when a new tab is opened (which mine is.) My Home Page is set to a page that 
uses the meta tag.

I've tried that and it doesn't crash for me. Can you please point me to that webpage 
which is your homepage? 
Also, go to start > Run > Type eventvwr. Select Application and check if you have any 
events recorded with source=chrome. Open that event and you should find a Crash Id. 
Please post that, if you can.

The site is on our Intranet, and you can't access it. 

However, I did find some events in the logs, but they are not source=chrome. Here's 
one, do you want the rest:

Log Name:      Application
Source:        Application Error
Date:          9/23/2009 11:23:00 AM
Event ID:      1000
Task Category: (100)
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      KDAVIS.pridedallas.com
Description:
Faulting application iexplore.exe, version 8.0.6001.18813, time stamp 0x4a6621ae, 
faulting module npchrome_tab.dll_unloaded, version 0.0.0.0, time stamp 0x4ab83764, 
exception code 0xc0000005, fault offset 0x6765f895, process id 0x1a10, application 
start time 0x01ca3c69e7825414.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Application Error" />
    <EventID Qualifiers="0">1000</EventID>
    <Level>2</Level>
    <Task>100</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2009-09-23T16:23:00.000Z" />
    <EventRecordID>7755</EventRecordID>
    <Channel>Application</Channel>
    <Computer>KDAVIS.pridedallas.com</Computer>
    <Security />
  </System>
  <EventData>
    <Data>iexplore.exe</Data>
    <Data>8.0.6001.18813</Data>
    <Data>4a6621ae</Data>
    <Data>npchrome_tab.dll_unloaded</Data>
    <Data>0.0.0.0</Data>
    <Data>4ab83764</Data>
    <Data>c0000005</Data>
    <Data>6765f895</Data>
    <Data>1a10</Data>
    <Data>01ca3c69e7825414</Data>
  </EventData>
</Event>

Amit or Alex might help.

(No comment was entered for this change.)

The following revision refers to this bug:
    http://src.chromium.org/viewvc/chrome?view=rev&revision=27191 

------------------------------------------------------------------------
r27191 | ananta@chromium.org | 2009-09-25 09:04:43 -0700 (Fri, 25 Sep 2009) | 16 lines
Changed paths:
   M http://src.chromium.org/viewvc/chrome/trunk/src/chrome_frame/bho.cc?r1=27191&r2=27190
   M http://src.chromium.org/viewvc/chrome/trunk/src/chrome_frame/protocol_sink_wrap.cc?r1=27191&r2=27190
   M http://src.chromium.org/viewvc/chrome/trunk/src/chrome_frame/protocol_sink_wrap.h?r1=27191&r2=27190
   M http://src.chromium.org/viewvc/chrome/trunk/src/chrome_frame/vtable_patch_manager.cc?r1=27191&r2=27190

This fixes a crash in IE8 with ChromeFrame when a new tab was created. 

ChromeFrame VTable patches the IInternetProtocol interface for the CLSID_HttpProtocol
and CLSID_HttpSProtocol handlers. However we were using the same VTable information to patch both
the handlers essentially overwriting the first one. While this all worked purely by chance, it
exposed a bug in IE8 where every new tab initially goes into a new process and if the chromeframe 
is unloaded we would leave behind an IInternetProtocol interface in urlmon patched, which would
crash when dereferenced.

Added a check in the VTable patching code for this case.

This fixes bug http://code.google.com/p/chromium/issues/detail?id=22768

Bug=22768

Review URL: http://codereview.chromium.org/244002
------------------------------------------------------------------------

(No comment was entered for this change.)

Remove label: Feedback Requested.

New Revision: 27191

Log:
This fixes a crash in IE8 with ChromeFrame when a new tab was created.

ChromeFrame VTable patches the IInternetProtocol interface for the CLSID_HttpProtocol
and CLSID_HttpSProtocol handlers. However we were using the same VTable information 
to patch both
the handlers essentially overwriting the first one. While this all worked purely by 
chance, it
exposed a bug in IE8 where every new tab initially goes into a new process and if the 
chromeframe
is unloaded we would leave behind an IInternetProtocol interface in urlmon patched, 
which would
crash when dereferenced.

Added a check in the VTable patching code for this case.

This fixes bug http://code.google.com/p/chromium/issues/detail?id=22768

Bug=22768

Review URL: http://codereview.chromium.org/244002

 Issue 24873  has been merged into this issue.