chromium/third_party/blink/web_tests/fast/events/access-key-self-destruct.html

<script>
function replace()
{
    document.getElementById("target").innerHTML = "If you can see this text and there was no crash, the test was a success.";
}
</script>
<body>
<p>This tests what happens when you use accesskey to trigger a script that causes a node to get destroyed
without ever having a reference to it from JavaScript. With older versions of WebKit this used to cause a crash.</p>
<p id="target"><a href="javascript:replace()" accesskey="a"></a>If you can see this text, the test was a failure.</p>
<script>
if (window.testRunner) {
    testRunner.dumpAsText();
    eventSender.keyDown("a", "accessKey");
}
</script>
</body>