Here, let's make the rendering issue simple:
Due to IE being so content help-happy there are a
myriad of IE-friend file types (e.g.-.jpg) that one
can simply rename a metafile to for purpose of web
exploitation, and IE will pull out the wonderful hey;
-automatically-handle trick err /feature/ for you.
Windows Explorer/My Computer preview/thumbnail thingy=IE
for purposes of rendering engine.
Stocking Stuffer Sploit-use Samples:
For your experimentation pleasure, I have benign JPEGs
and one WMF with modified extension names found here:
Examples include WMF file skatebrd.wmf ~renamed~ skatebrd.doc
candy is a JPEG also renamed doc, and win32api is a JPEG
renamed to wmf. Mix and match to your hearts content.