gecko-dev/layout/style/crashtests/1640040.html

<script>
window.onload = () => {
  b.type = ""
  document.getSelection().selectAllChildren(a)
  b.placeholder = ""
  b.setRangeText(String.fromCodePoint(814688))
}
</script>
<menu spellcheck="true">
<input id="b" autofocus="" type="button">
<menu id="a">