chromium/content/test/data/accessibility/regression/xml-in-iframe-crash.html

<script>
function shouldNotBeExecuted()
{
    var divElement = document.createElement("div");
    document.body.appendChild(divElement);
}
</script>
<body onLoad="shouldNotBeExecuted();">
  <iframe src="foo.xml"/>