Then lobbeth thou thy Holy Crashtest of Antioch towards thou foe, who being naughty in my sight, shall snuff it. [Commit message suggested by aja]

dom/src/base/crashtests/404869-1.xul

@@ -0,0 +1,23 @@
+<?xml version="1.0"?>
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" onload="boom();">
+        
+<bindings xmlns="http://www.mozilla.org/xbl">
+  <binding id="empty"><content></content></binding>
+</bindings>
+
+<script type="text/javascript">
+
+function boom()
+{
+  var menupopup = document.getElementById("menupopup");
+  var x = document.getAnonymousNodes(menupopup)[0];
+  menupopup.style.MozBinding = "url('#empty')";
+  for (var ppp in x) {
+  }
+}
+
+</script>
+
+<menupopup id="menupopup"/>
+
+</window>

dom/src/base/crashtests/crashtests.list

@@ -2,3 +2,4 @@ load 327571-1.html
 load 327695-1.html
 load 369413-1.html
 load 372554-1.html
+load 404869-1.xul