I'll get you, my pretty, and your little crashtest, too! [Checkin comment suggested by aja.]

content/base/crashtests/354645-1.xul

@@ -0,0 +1,25 @@
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" onload="boom();" class="reftest-wait">
+
+<script type="text/javascript">
+
+var XUL_NS = "http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul";
+
+function boom()
+{
+  var A = document.getElementById("A");
+  var B = document.createElementNS(XUL_NS, "tabs");
+  var C = document.createElementNS(XUL_NS, "hbox");
+  B.appendChild(C);
+  A.appendChild(B);
+}
+
+function remove(n)
+{
+  n.parentNode.removeChild(n);
+}
+
+</script>
+
+<hbox id="A" onselect="remove(event.originalTarget); document.documentElement.removeAttribute('class');"></hbox>
+
+</window>

content/base/crashtests/crashtests.list

@@ -11,6 +11,7 @@ load 343730-1.xhtml
 load 343850-1.xhtml
 load 348049-1.xhtml
 load 344882-1.html
+load 354645-1.xul
 load 386000-1.html
 load 386794-1.html
 load 399712-1.html