As promised, I looked further at the dump when I had more time. I did verify it's running a "toolbar", specifically it's trying to run the toolbar {4b78d326-d922-44f9-af2a-07805c2a3560}, which appears to be the IE menu band (makes sense, the tools menu is a menu band) coming from ieframe.dll. Since this particular toolband can have hooks into it to display custom menu items, I took a look deeper at the RPC call in the stack to see where that was going. What I found was that it is making a local RPC call, but out-of-process to process 1412 (IE's process PID is 508 in this dump). The registered server interface that IE is calling into is {67DFD707-8549-483F-9B63-FF054EDB5428}, which is a COM component called "iwpcintegrate" - this appears to be a component of the Windows Live Family Safety components (probably the Parental Controls module, given that this interface is registered to be engaged when clicking the Tools menu as it has hooks there).
To recap, like I mentioned earlier, in this IE process thread 0 is waiting on thread 15, which is making this RPC call to what appears to be Windows Live Parental Controls. It has a timeout of 0xffffffff, or infinity - as long as the iwpcintegrate COM component never responds, thread 15 in IE will be stuck waiting for that response, which blocks thread 0 from updating the UI, causing IE to appear hung (it's not, but it can no longer redraw or respond to shell or mouse messages, as the frame message pump is on thread 0). Thus, removing this particular windows live essentials component (at the least) would be a good test, as that's where the RPC call dies.