diff --git a/layout/base/crashtests/366967-1.html b/layout/base/crashtests/366967-1.html
new file mode 100644
index 00000000000..f8e63d96f6b
--- /dev/null
+++ b/layout/base/crashtests/366967-1.html
@@ -0,0 +1,33 @@
+<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
+                      "http://www.w3.org/TR/html4/loose.dtd">
+<html class="reftest-wait">
+<head>
+  
+<style>
+#cat { float: left; }
+#zebra { background: lightgreen; }
+#zebra:after { content: "a b c d e"; }
+#zebra:first-letter { display: none; }
+</style>
+  
+<script>
+function boom1()
+{
+  document.getElementById("cat").style.outline = "1px solid yellow";
+  setTimeout(boom2, 30);
+}
+
+function boom2()
+{
+  document.getElementById("cat").style.overflow = "auto";
+  document.documentElement.removeAttribute("class")
+}
+</script>
+
+</head>
+
+<body onload="setTimeout(boom1, 30)" style="overflow: scroll">
+  <div id="zebra"><b id="cat">Cat</b></div>
+  <div style="direction: rtl">This is an RTL div</div>
+</body>
+</html>
diff --git a/layout/base/crashtests/crashtests.list b/layout/base/crashtests/crashtests.list
index 22cccd0218e..3ba06a0e751 100644
--- a/layout/base/crashtests/crashtests.list
+++ b/layout/base/crashtests/crashtests.list
@@ -13,5 +13,6 @@ load 343540-1.html
 load 349095-1.xhtml
 load 350128-1.xhtml
 load 364427-1.html
+load 366967-1.html
 load 379920-1.svg
 load 379920-1.svg
