After many tests, it turns out address 0x0c0d2020 is the most consistent location acorss various IE versions. For dev purposes, it's rather important to have this documented somewhere. Thanks to corelanc0d3r for the data.