gecko-dev/dom/xbl/crashtests/406900-1.xul

<?xml version="1.0"?>
<?xml-stylesheet href="chrome://global/skin/" type="text/css"?>
<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
        xmlns:xul="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
        onload="boom();">

<bindings xmlns="http://www.mozilla.org/xbl">
  <binding id="lit">
    <content>
      <children>
        <xul:hbox/>
      </children>
    </content>
  </binding>
</bindings>

<script type="text/javascript"> 

function boom()
{
  var x = document.getElementById("x");
  var anon = document.getAnonymousNodes(x)[0];
  document.documentElement.removeChild(x);
  document.documentElement.appendChild(x);
  var hbox = document.createXULElement('hbox');
  anon.appendChild(hbox);
}

</script>

<hbox id="x" style="-moz-binding: url(#lit)" />

</window>