gecko-dev/dom/html/crashtests/877910.html

<select><option id="foo"><script>document.querySelector("select").namedItem("foo")</script>