Add crashtest

layout/xul/base/src/tree/src/crashtests/409807-1.xul

@@ -0,0 +1,25 @@
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" onload="boom();">
+
+<script type="text/javascript">
+
+function boom()
+{
+  var tree = document.getElementById("tree");
+  var tc = document.createElementNS("http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul", "treechildren");
+  
+  document.addEventListener("DOMAttrModified", m, false);
+  
+  tree.appendChild(tc);
+  
+  function m()
+  {
+    document.removeEventListener("DOMAttrModified", m, false);
+    tree.removeChild(tc);
+  }
+}
+
+</script>
+
+<tree id="tree" />
+
+</window>

layout/xul/base/src/tree/src/crashtests/crashtests.list

@@ -6,3 +6,4 @@ load 380217-1.xul
 load 393665-1.xul
 load 399692-1.xhtml
 load 399715-1.xhtml
+load 409807-1.xul