<script>
if (window.testRunner)
testRunner.dumpAsText();
onload = function()
{
document.body.attributes.setNamedItem(null);
}
</script>
This passes if it does not crash. (see https://bugs.webkit.org/show_bug.cgi?id=18958)