chromium/third_party/blink/manual_tests/open-close-tokenizer-crash.html

<html>
    <body>
        <input type="button" value="Click Here" onclick="window.open('resources/open-close-tokenizer-crash.html', 'foo');"> 
        Click the button above. Another browser window should open and then immediately close without crashing.
    </body>
</html>