diff --git a/layout/mathml/crashtests/348811-1.xhtml b/layout/mathml/crashtests/348811-1.xhtml
new file mode 100644
index 00000000000..367cc32bec5
--- /dev/null
+++ b/layout/mathml/crashtests/348811-1.xhtml
@@ -0,0 +1,26 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<script>
+function foo()
+{
+  var newTable = document.createElementNS("http://www.w3.org/1998/Math/MathML", "mtable")
+
+  document.getElementById("mtr").appendChild(newTable);
+}
+</script>
+</head>
+
+<body onload="foo()">
+
+
+<div>
+  <math xmlns="http://www.w3.org/1998/Math/MathML" display="block">
+    <mtable>      <mtr id="mtr">         <mtd>
+           <mi>x</mi>
+         </mtd>      </mtr>    </mtable>  </math>
+</div>
+     
+
+</body>
+
+</html>
\ No newline at end of file
diff --git a/layout/mathml/crashtests/348811-2.xhtml b/layout/mathml/crashtests/348811-2.xhtml
new file mode 100644
index 00000000000..30f7943a98b
--- /dev/null
+++ b/layout/mathml/crashtests/348811-2.xhtml
@@ -0,0 +1,31 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<script>
+function foo()
+{
+  var m = "http://www.w3.org/1998/Math/MathML";
+  var newTable = document.createElementNS(m, "mtable")
+  document.getElementById("mtable").appendChild(newTable);
+}
+</script>
+</head>
+
+<body onload="foo()">
+
+
+<div>
+  <math xmlns="http://www.w3.org/1998/Math/MathML" display="block">
+    <mtable id="mtable">
+      <mtr id="mtr">
+         <mtd>
+           <mi>x</mi>
+         </mtd>
+      </mtr>
+    </mtable>
+  </math>
+</div>
+     
+
+</body>
+
+</html>
\ No newline at end of file
diff --git a/layout/mathml/crashtests/crashtests.list b/layout/mathml/crashtests/crashtests.list
index f785d97ff90..a86af0cbb37 100644
--- a/layout/mathml/crashtests/crashtests.list
+++ b/layout/mathml/crashtests/crashtests.list
@@ -10,6 +10,8 @@ load 336074-1.xhtml
 load 347495-1.xhtml
 load 347507-1.xhtml
 load 348492-1.xhtml
+load 348811-1.xhtml
+load 348811-2.xhtml
 load 355986-1.xhtml
 load 364685-1.xhtml
 load 366012-1.xhtml
