gecko-dev/dom/base/crashtests/1377826.html

<li id='a' dir='auto'>
<select>
<option dir='rtl'>
&#x8C3;
</html>