diff --git a/reactos/dll/win32/ieframe/client.c b/reactos/dll/win32/ieframe/client.c
index ff0fbb88614..5cab2b7d251 100644
--- a/reactos/dll/win32/ieframe/client.c
+++ b/reactos/dll/win32/ieframe/client.c
@@ -288,7 +288,7 @@ static HRESULT WINAPI InPlaceSite_OnInPlaceActivateEx(IOleInPlaceSiteEx *iface,
     TRACE("(%p)->(%p, %x)\n", This, pfNoRedraw, dwFlags);
 
     /* FIXME: Avoid redraw, when possible */
-    pfNoRedraw = FALSE;
+    *pfNoRedraw = FALSE;
 
     if (dwFlags) {
         FIXME("dwFlags not supported (%x)\n", dwFlags);
diff --git a/reactos/dll/win32/ieframe/dochost.c b/reactos/dll/win32/ieframe/dochost.c
index ec9399a56e9..66d177755aa 100644
--- a/reactos/dll/win32/ieframe/dochost.c
+++ b/reactos/dll/win32/ieframe/dochost.c
@@ -525,12 +525,15 @@ void deactivate_document(DocHost *This)
     This->document = NULL;
 }
 
-HRESULT refresh_document(DocHost *This)
+HRESULT refresh_document(DocHost *This, const VARIANT *level)
 {
     IOleCommandTarget *cmdtrg;
     VARIANT vin, vout;
     HRESULT hres;
 
+    if(level && (V_VT(level) != VT_I4 || V_I4(level) != REFRESH_NORMAL))
+        FIXME("Unsupported refresh level %s\n", debugstr_variant(level));
+
     if(!This->document) {
         FIXME("no document\n");
         return E_FAIL;
diff --git a/reactos/dll/win32/ieframe/ie.c b/reactos/dll/win32/ieframe/ie.c
index f65b147ef07..5b32fa1d6ab 100644
--- a/reactos/dll/win32/ieframe/ie.c
+++ b/reactos/dll/win32/ieframe/ie.c
@@ -178,14 +178,16 @@ static HRESULT WINAPI InternetExplorer_Refresh(IWebBrowser2 *iface)
 
     TRACE("(%p)\n", This);
 
-    return refresh_document(&This->doc_host);
+    return refresh_document(&This->doc_host, NULL);
 }
 
 static HRESULT WINAPI InternetExplorer_Refresh2(IWebBrowser2 *iface, VARIANT *Level)
 {
     InternetExplorer *This = impl_from_IWebBrowser2(iface);
-    FIXME("(%p)->(%p)\n", This, Level);
-    return E_NOTIMPL;
+
+    TRACE("(%p)->(%p)\n", This, Level);
+
+    return refresh_document(&This->doc_host, Level);
 }
 
 static HRESULT WINAPI InternetExplorer_Stop(IWebBrowser2 *iface)
diff --git a/reactos/dll/win32/ieframe/ieframe.h b/reactos/dll/win32/ieframe/ieframe.h
index 15c7ae5ce4e..33ab0d3ef39 100644
--- a/reactos/dll/win32/ieframe/ieframe.h
+++ b/reactos/dll/win32/ieframe/ieframe.h
@@ -281,7 +281,7 @@ HRESULT navigate_url(DocHost*,LPCWSTR,const VARIANT*,const VARIANT*,VARIANT*,VAR
 HRESULT go_home(DocHost*) DECLSPEC_HIDDEN;
 HRESULT go_back(DocHost*) DECLSPEC_HIDDEN;
 HRESULT go_forward(DocHost*) DECLSPEC_HIDDEN;
-HRESULT refresh_document(DocHost*) DECLSPEC_HIDDEN;
+HRESULT refresh_document(DocHost*,const VARIANT*) DECLSPEC_HIDDEN;
 HRESULT get_location_url(DocHost*,BSTR*) DECLSPEC_HIDDEN;
 HRESULT set_dochost_url(DocHost*,const WCHAR*) DECLSPEC_HIDDEN;
 void handle_navigation_error(DocHost*,HRESULT,BSTR,IHTMLWindow2*) DECLSPEC_HIDDEN;
@@ -289,6 +289,7 @@ HRESULT dochost_object_available(DocHost*,IUnknown*) DECLSPEC_HIDDEN;
 void set_doc_state(DocHost*,READYSTATE) DECLSPEC_HIDDEN;
 void deactivate_document(DocHost*) DECLSPEC_HIDDEN;
 void create_doc_view_hwnd(DocHost*) DECLSPEC_HIDDEN;
+void on_commandstate_change(DocHost*,LONG,VARIANT_BOOL) DECLSPEC_HIDDEN;
 
 #define WM_DOCHOSTTASK (WM_USER+0x300)
 void push_dochost_task(DocHost*,task_header_t*,task_proc_t,task_destr_t,BOOL) DECLSPEC_HIDDEN;
diff --git a/reactos/dll/win32/ieframe/iexplore.c b/reactos/dll/win32/ieframe/iexplore.c
index 7ffe1f4c735..9a32b6c9353 100644
--- a/reactos/dll/win32/ieframe/iexplore.c
+++ b/reactos/dll/win32/ieframe/iexplore.c
@@ -700,7 +700,7 @@ void register_iewindow_class(void)
     wc.hIcon = LoadIconW(GetModuleHandleW(0), MAKEINTRESOURCEW(IDI_APPICON));
     wc.hIconSm = LoadImageW(GetModuleHandleW(0), MAKEINTRESOURCEW(IDI_APPICON), IMAGE_ICON,
                             GetSystemMetrics(SM_CXSMICON), GetSystemMetrics(SM_CYSMICON), LR_SHARED);
-    wc.hCursor = LoadCursorW(0, MAKEINTRESOURCEW(IDC_ARROW));
+    wc.hCursor = LoadCursorW(0, (LPWSTR)IDC_ARROW);
     wc.hbrBackground = 0;
     wc.lpszClassName = szIEWinFrame;
     wc.lpszMenuName = NULL;
diff --git a/reactos/dll/win32/ieframe/navigate.c b/reactos/dll/win32/ieframe/navigate.c
index 5de2543faa9..75501642f14 100644
--- a/reactos/dll/win32/ieframe/navigate.c
+++ b/reactos/dll/win32/ieframe/navigate.c
@@ -759,6 +759,27 @@ static void doc_navigate_task_destr(task_header_t *t)
     heap_free(task);
 }
 
+void on_commandstate_change(DocHost *doc_host, LONG command, VARIANT_BOOL enable)
+{
+    DISPPARAMS dispparams;
+    VARIANTARG params[2];
+
+    TRACE("command=%d enable=%d\n", command, enable);
+
+    dispparams.cArgs = 2;
+    dispparams.cNamedArgs = 0;
+    dispparams.rgdispidNamedArgs = NULL;
+    dispparams.rgvarg = params;
+
+    V_VT(params) = VT_BOOL;
+    V_BOOL(params) = enable;
+
+    V_VT(params+1) = VT_I4;
+    V_I4(params+1) = command;
+
+    call_sink(doc_host->cps.wbe2, DISPID_COMMANDSTATECHANGE, &dispparams);
+}
+
 static void doc_navigate_proc(DocHost *This, task_header_t *t)
 {
     task_doc_navigate_t *task = (task_doc_navigate_t*)t;
@@ -862,6 +883,9 @@ static HRESULT navigate_bsc(DocHost *This, BindStatusCallback *bsc, IMoniker *mo
         return S_OK;
     }
 
+    on_commandstate_change(This, CSC_NAVIGATEBACK, VARIANT_FALSE);
+    on_commandstate_change(This, CSC_NAVIGATEFORWARD, VARIANT_FALSE);
+
     if(This->document)
         deactivate_document(This);
 
@@ -1055,6 +1079,17 @@ static HRESULT navigate_history(DocHost *This, unsigned travellog_pos)
         return E_NOTIMPL;
     }
 
+    if (travellog_pos < This->travellog.position)
+    {
+        on_commandstate_change(This, CSC_NAVIGATEBACK, VARIANT_FALSE);
+        on_commandstate_change(This, CSC_NAVIGATEFORWARD, VARIANT_TRUE);
+    }
+    else if (travellog_pos > This->travellog.position)
+    {
+        on_commandstate_change(This, CSC_NAVIGATEBACK, VARIANT_TRUE);
+        on_commandstate_change(This, CSC_NAVIGATEFORWARD, VARIANT_FALSE);
+    }
+
     This->travellog.loading_pos = travellog_pos;
     entry = This->travellog.log + This->travellog.loading_pos;
 
diff --git a/reactos/dll/win32/ieframe/oleobject.c b/reactos/dll/win32/ieframe/oleobject.c
index 92a9696ec3b..a0268424915 100644
--- a/reactos/dll/win32/ieframe/oleobject.c
+++ b/reactos/dll/win32/ieframe/oleobject.c
@@ -282,8 +282,8 @@ static void release_client_site(WebBrowser *This)
 
 typedef struct {
     IEnumOLEVERB IEnumOLEVERB_iface;
-
     LONG ref;
+    LONG iter;
 } EnumOLEVERB;
 
 static inline EnumOLEVERB *impl_from_IEnumOLEVERB(IEnumOLEVERB *iface)
@@ -338,10 +338,20 @@ static HRESULT WINAPI EnumOLEVERB_Next(IEnumOLEVERB *iface, ULONG celt, OLEVERB
 {
     EnumOLEVERB *This = impl_from_IEnumOLEVERB(iface);
 
+    static const OLEVERB verbs[] =
+        {{OLEIVERB_PRIMARY},{OLEIVERB_INPLACEACTIVATE},{OLEIVERB_UIACTIVATE},{OLEIVERB_SHOW},{OLEIVERB_HIDE}};
+
     TRACE("(%p)->(%u %p %p)\n", This, celt, rgelt, pceltFetched);
 
+    /* There are a few problems with this implementation, but that's how it seems to work in native. See tests. */
     if(pceltFetched)
         *pceltFetched = 0;
+
+    if(This->iter == sizeof(verbs)/sizeof(*verbs))
+        return S_FALSE;
+
+    if(celt)
+        *rgelt = verbs[This->iter++];
     return S_OK;
 }
 
@@ -355,7 +365,10 @@ static HRESULT WINAPI EnumOLEVERB_Skip(IEnumOLEVERB *iface, ULONG celt)
 static HRESULT WINAPI EnumOLEVERB_Reset(IEnumOLEVERB *iface)
 {
     EnumOLEVERB *This = impl_from_IEnumOLEVERB(iface);
+
     TRACE("(%p)\n", This);
+
+    This->iter = 0;
     return S_OK;
 }
 
@@ -419,6 +432,9 @@ static HRESULT WINAPI OleObject_SetClientSite(IOleObject *iface, LPOLECLIENTSITE
     release_client_site(This);
 
     if(!pClientSite) {
+        on_commandstate_change(&This->doc_host, CSC_NAVIGATEBACK, VARIANT_FALSE);
+        on_commandstate_change(&This->doc_host, CSC_NAVIGATEFORWARD, VARIANT_FALSE);
+
         if(This->doc_host.document)
             deactivate_document(&This->doc_host);
         return S_OK;
@@ -589,6 +605,7 @@ static HRESULT WINAPI OleObject_EnumVerbs(IOleObject *iface, IEnumOLEVERB **ppEn
 
     ret->IEnumOLEVERB_iface.lpVtbl = &EnumOLEVERBVtbl;
     ret->ref = 1;
+    ret->iter = 0;
 
     *ppEnumOleVerb = &ret->IEnumOLEVERB_iface;
     return S_OK;
diff --git a/reactos/dll/win32/ieframe/shellbrowser.c b/reactos/dll/win32/ieframe/shellbrowser.c
index 7c728bbb757..73995c8f363 100644
--- a/reactos/dll/win32/ieframe/shellbrowser.c
+++ b/reactos/dll/win32/ieframe/shellbrowser.c
@@ -703,10 +703,15 @@ static HRESULT WINAPI DocObjectService_FireBeforeNavigate2(
     V_VT(params+6) = (VT_DISPATCH);
     V_DISPATCH(params+6) = (IDispatch*)This->doc_host->wb;
 
+    /* Keep reference to This. It may be released in event handler. */
+    IShellBrowser_AddRef(&This->IShellBrowser_iface);
+
     TRACE(">>>\n");
     call_sink(This->doc_host->cps.wbe2, DISPID_BEFORENAVIGATE2, &dp);
     TRACE("<<<\n");
 
+    IShellBrowser_Release(&This->IShellBrowser_iface);
+
     SysFreeString(V_BSTR(&var_url));
     SysFreeString(V_BSTR(&var_headers));
     SysFreeString(V_BSTR(&var_frame_name));
@@ -759,6 +764,9 @@ static HRESULT WINAPI DocObjectService_FireNavigateComplete2(
     V_VT(&url_var) = VT_BSTR;
     V_BSTR(&url_var) = url;
 
+    /* Keep reference to This. It may be released in event handler. */
+    IShellBrowser_AddRef(&This->IShellBrowser_iface);
+
     TRACE(">>>\n");
     call_sink(This->doc_host->cps.wbe2, DISPID_NAVIGATECOMPLETE2, &dp);
     TRACE("<<<\n");
@@ -766,6 +774,7 @@ static HRESULT WINAPI DocObjectService_FireNavigateComplete2(
     SysFreeString(url);
 
     This->doc_host->busy = VARIANT_FALSE;
+    IShellBrowser_Release(&This->IShellBrowser_iface);
     return S_OK;
 }
 
diff --git a/reactos/dll/win32/ieframe/webbrowser.c b/reactos/dll/win32/ieframe/webbrowser.c
index 779730c3b76..bffcd727088 100644
--- a/reactos/dll/win32/ieframe/webbrowser.c
+++ b/reactos/dll/win32/ieframe/webbrowser.c
@@ -289,14 +289,16 @@ static HRESULT WINAPI WebBrowser_Refresh(IWebBrowser2 *iface)
 
     TRACE("(%p)\n", This);
 
-    return refresh_document(&This->doc_host);
+    return refresh_document(&This->doc_host, NULL);
 }
 
 static HRESULT WINAPI WebBrowser_Refresh2(IWebBrowser2 *iface, VARIANT *Level)
 {
     WebBrowser *This = impl_from_IWebBrowser2(iface);
-    FIXME("(%p)->(%s)\n", This, debugstr_variant(Level));
-    return E_NOTIMPL;
+
+    TRACE("(%p)->(%s)\n", This, debugstr_variant(Level));
+
+    return refresh_document(&This->doc_host, Level);
 }
 
 static HRESULT WINAPI WebBrowser_Stop(IWebBrowser2 *iface)
@@ -934,7 +936,12 @@ static HRESULT WINAPI WebBrowser_get_RegisterAsDropTarget(IWebBrowser2 *iface,
         VARIANT_BOOL *pbRegister)
 {
     WebBrowser *This = impl_from_IWebBrowser2(iface);
+
     FIXME("(%p)->(%p)\n", This, pbRegister);
+
+    if(!pbRegister)
+        return E_INVALIDARG;
+
     *pbRegister=0;
     return S_OK;
 }
diff --git a/reactos/media/doc/README.WINE b/reactos/media/doc/README.WINE
index db35e7567a2..73a678ecfce 100644
--- a/reactos/media/doc/README.WINE
+++ b/reactos/media/doc/README.WINE
@@ -83,7 +83,7 @@ reactos/dll/win32/hnetcfg             # Synced to WineStaging-1.7.37
 reactos/dll/win32/httpapi             # Synced to Wine-1.7.27
 reactos/dll/win32/iccvid              # Synced to WineStaging-1.7.37
 reactos/dll/win32/icmp                # Out of sync
-reactos/dll/win32/ieframe             # Synced to Wine-1.7.27
+reactos/dll/win32/ieframe             # Synced to WineStaging-1.7.37
 reactos/dll/win32/imaadp32.acm        # Synced to Wine-1.7.27
 reactos/dll/win32/imagehlp            # Synced to Wine-1.7.27
 reactos/dll/win32/imm32               # Synced to Wine-1.7.27