Bug 538308. Add crashtest.

layout/xul/base/src/crashtests/538308-1.xul

@@ -0,0 +1,32 @@
+<?xml version="1.0"?>
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
+        xmlns:html="http://www.w3.org/1999/xhtml"
+        onload="run()">
+
+    <tree id="tr" flex="1">
+        <treecols>
+            <treecol/>
+        </treecols>
+        <treechildren>
+            <html:optgroup id="group">
+                <html:option id="victim" label="never see this"/>
+            </html:optgroup>
+        </treechildren>
+    </tree>
+
+    <script type="text/javascript"><![CDATA[
+    function run() {
+        group = document.getElementById("group");
+        tc = document.createElement("treechildren");
+        group.appendChild(tc);
+
+        v = document.getElementById("victim");
+        v.parentNode.removeChild(v);
+        v = null;
+
+        tree = document.getElementById("tr");
+        col = tree.columns[0];
+        alert(tree.view.getItemAtIndex(1, col)); 
+    }
+    ]]></script>
+</window>

layout/xul/base/src/crashtests/crashtests.list

@@ -71,4 +71,5 @@ load 508927-1.xul
 load 508927-2.xul
 load 514300-1.xul
 load 536931-1.xhtml
+load 538308-1.xul
 load menulist-focused.xhtml