I humbly submit this number must be very low, because fixing a bug in a widely deployed product is not as easy as you believe it is.
For instance maybe fixing the bug in crashie8.com would break a lot of websites relying (indirectly) on that bug.
It's easy to have your very own definition of "modern" and then say "This is not modern, because modern means having a yellow status bar".
Actually when you said that PHP is a modern language I must say that your definition of modern sounded pretty different than mine.
Lastly, I challenge you to find a single currently working crash-the-computer bug in IE9. Crash the tab, yes. Crash the browser, maybe. Crash the computer, very unlikely.
The thing is, web browsers are always going to have to deal with two kinds of people: The malicious and the incompetent. They both write web pages, and neither can be avoided completely.
And, when you get down to it, it's impossible to distinguish sufficiently advanced incompetence from malice. (This sentiment seems quite appropriate when discussing Microsoft's browsers.)