diff --git a/layout/base/crashtests/406675-1.html b/layout/base/crashtests/406675-1.html
new file mode 100644
index 000000000000..779d82b675ce
--- /dev/null
+++ b/layout/base/crashtests/406675-1.html
@@ -0,0 +1,17 @@
+<html>
+<head>
+<script type="text/javascript">
+
+function boom()
+{
+  var textNode = document.createTextNode("\u202B" + "A B");
+  document.body.appendChild(textNode);
+  document.body.offsetHeight;
+  textNode.data = "\u202B" + " C";
+}
+
+</script>
+</head>
+
+<body onload="boom();"></body>
+</html>
diff --git a/layout/base/crashtests/crashtests.list b/layout/base/crashtests/crashtests.list
index 8d0ef275f688..9865ca867a0f 100644
--- a/layout/base/crashtests/crashtests.list
+++ b/layout/base/crashtests/crashtests.list
@@ -95,6 +95,7 @@ load 403569-3.xhtml
 load 404218-1.xhtml
 load 405184-1.xhtml
 load 405186-1.xhtml
+load 406675-1.html
 load 408292.html
 load 408299.html
 load 409513.html
