chromium/third_party/blink/web_tests/fast/frames/onload-remove-iframe-crash.html

<p>This test checks for a crash that once happened in WebKit. The crash was caused
by an onload handler for a synchronously loaded iframe removing the iframe from the 
document.
</p>
<p>(For compatibility, WebKit loads about:blank and javascript: URLs synchronously).
</p>
<hr>
<p>PASS: You didn't crash.
</p>

<div id="div"></div>

<script>
if (window.testRunner)
    testRunner.dumpAsText();

document.getElementById('div').innerHTML = '<iframe src="about:blank" onload="this.parentNode.removeChild(this)"></iframe>';
</script>