Codebase Browser
chromium
Go to App

chromium/third_party/blink/manual_tests/remove-on-drop-crash.html 

<body>
Load <a href="http://www.google.com/">Google</a> and drag the logo onto this page.  The second time you drag it on, Safari will crash.
<script>
function deleteSelection() {
  document.execCommand("delete");
}
document.designMode="on";
document.body.addEventListener("DOMNodeInserted", deleteSelection, false);
</script>
</body>