diff --git a/layout/base/crashtests/496011-1.xhtml b/layout/base/crashtests/496011-1.xhtml
new file mode 100644
index 000000000000..1fabb4dbeb73
--- /dev/null
+++ b/layout/base/crashtests/496011-1.xhtml
@@ -0,0 +1,20 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<script type="text/javascript">
+<![CDATA[
+
+function boom()
+{
+  document.body.setAttribute("contenteditable", "true");
+  document.execCommand("selectAll", false, null);
+  document.execCommand("inserthtml", false, "<span><div><\/div><\/span>");
+  document.execCommand("undo", false, null);
+}
+
+]]>
+</script>
+</head>
+
+<body onload="boom();"><textarea><span/></textarea></body>
+
+</html>
diff --git a/layout/base/crashtests/crashtests.list b/layout/base/crashtests/crashtests.list
index 893f45a2a889..ea4e2fa2c0b2 100644
--- a/layout/base/crashtests/crashtests.list
+++ b/layout/base/crashtests/crashtests.list
@@ -269,6 +269,7 @@ load 492014.xhtml
 load 492112-1.xhtml
 load 492163-1.xhtml
 load 495350-1.html
+load 496011-1.xhtml
 load 497519-1.xhtml
 load 497519-2.xhtml
 load 499741-1.xhtml
