gecko-dev/js/xpconnect/crashtests/394810-1.html

<script>
Object.prototype.__defineGetter__("x", Object.prototype.toSource);
window.x;
</script>