chromium/third_party/blink/web_tests/fast/events/resources/frontpage.html

<html>
  <head>
  </head>
  <body>
     To reproduce the original crash outside of DumpRenderTree, press option-tab twice. After focusing the
     link below on the first option-tab, the focus loop will try to focus the unloaded frame on the second
     and crash.
     <a href="">Crash</a>
  </body>
</html>