gecko-dev/content/base/crashtests/308120-1.xul

<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" onload="var button=document.getElementsByTagName('button')[0]; try { button.appendChild(document.getAnonymousNodes(button)[0]); } catch(e) { }">
  <button/>
</window>