Well, this fix was done more than three years ago, but this is one of most evil IE bugs in existence. Even better, it seems to have never been fixed, exists in IE7, and is being discussed in various places lately.
The problem is very simple – valid PNG files can be uploaded to various sites, and then shown to users. The problem is that IE does autodetection, and if it suspects that the file may be HTML, it executes it as HTML, with all Javascript inside. The images can be properly normal images, that show your kitten or wife or whatever. Still, IE will execute any exploit code that is included in them. Exploit code can actually load the actual image, so nobody will even realize they’re looking at image and not at an attack that hijacks their sessions, steals cookies and does all other sorts of evil things.
So, whenever anyone says IE is secure, just tell them to look at this problem.
domas mituzas 
IE still does auto-detection, however they have recently added a signature for PNG files (in the MS07-057 patch), so valid PNG files will never be recognised as HTML any more.
Not that IE is perfect or anything, but this issue is not so much of an issue now that JPG/GIF/PNG files will never be detected as html.
We can only hope that other XSS bugs can also be fixed in the same 3-year-plus time window. :)
With PNG files – yes, it is fixed. With other types, e.g., PDF – still exists.
The link to the fix is broken. Is another file available elsewhere?
I just stumbled upon this page again, and I just had a look at the mediawiki fix you link to, and it’s vulnerable.
There are a bunch of other strings you need to filter (which I can’t past here due to wordpress filtering) and you need to check the first 256 bytes, rather than the first 200 bytes.