chromium/third_party/blink/manual_tests/onunload-form-submit-crash.html

<html>
<body onUnload="document.myForm.submit()">
<a href="" onClick="location.href=location.href; return false;">Click here and see if Safari crashes.</a>
<p>Still with me? Now close the window and see if Safari crashes.</p>
<form name="myForm">
</form>
</body>
<html>