Turns out that if you create an input control on the fly in IE6 and stuff it into the DOM tree, it gets inserted into its form’s elements array, but not into the associated hashtable. It’s there and not there all at the same time...

      if (!iewin || theForm.elements[theField])
	theField=theForm.elements[theField];
      else // it beggars belief, really
	for (var i=0; i<theForm.elements.length; i++)
	  if (theForm.elements[i].name==theField) {
	    theField=theForm.elements[i];
	    break;
	  }

MS have been kind enough to retain backward compatibility on this “feature” in IE7.