gecko-dev/layout/base/crashtests/629035-1.html

<script>
  document.dir = "rtl";
</script>