chromium/third_party/blink/web_tests/external/wpt/html/semantics/embedded-content/the-img-element/img-created-in-active-document-crash.html

<iframe id="i"></iframe>
<script>
var doc = i.contentDocument;
i.remove();
doc.createElement("img");
</script>