gecko-dev/dom/jsurl/crashtests/341963-1.html

<script>

location = "javascript:x.x.x";

for(var i in {})
  ;

</script>