chromium/third_party/blink/web_tests/external/wpt/accessibility/crashtests/activedescendant-crash.html

<iframe></iframe>
<script>
let frame = document.querySelector("iframe");
window.xyz = frame.contentWindow.accessibilityController.focusedElement;
frame.remove();
window.xyz.activeDescendant;
</script>