You specify the control that you want to load using a string that you pass to the ATL hosting code. This string can be raw HTML (prefixed with "MSHTML:"), a ProgID, a CLSID (which must be in registry format with the braces), or a URL. If you pass an invalid ProgID (one for which a corresponding CLSID can't be found), an invalid CLSID (it doesn't have the braces), or if the control corresponding to a valid ProgID or CLSID can't be successfully loaded, the ATL code will assume that the string you have passed is actually a URL to which the Web browser should navigate. This causes the Web browser to load.
If you're experiencing this problem, check that the string you are passing is in the correct format. If it is, you'll need to investigate the reasons that the requested control isn't being loaded.
Note In a future version of ATL, if the text that you supply can be successfully validated as a ProgID or CLSID (even if the corresponding control can't be loaded), it will not be passed to the Web browser as if it were a URL. Only an invalid ProgID or CLSID (or a valid URL or HTML) will cause the Web browser to load.