That's "just" a browser freeze for end users, but still a potential DOS vulnerability if it's in the application's critical path.