chromium/third_party/blink/web_tests/fast/dom/Window/open-window-features-fuzz.html

<script>

if (window.testRunner) {
  testRunner.dumpAsText();
  testRunner.setPopupBlockingEnabled(false);
}

function handler() {
  var url = 'rV1IRI:I';
  var name = 'listing';
  var features = unescape('%udc10%u0130%u07b2%u037c%ufb3b%u3bf0%u3e4d%u16c3%u3c4f%u3fe7%u12b3%ub73c%u6c25%u938d%u645c%u2470%udbc3%ud2d4');
  window.open(url, name, features);
}

</script>

<body>
<p>Should not crash.
<audio src="poly" onloadstart="handler()">