chromium/third_party/blink/web_tests/fast/parser/head-content-after-head-removal.html

<head></head>

<script>
    if (window.testRunner)
        testRunner.dumpAsText();

    // Blow away the <head> element above in a way that doesn't create a JavaScript wrapper.
    document.documentElement.innerHTML = "";
</script>

<title>
    This element gets put into the head by the parser, but we deleted the head!
</title>

<body>
    If you can see this text without crashing, the test passed.
    <script>
        if (document.getElementsByTagName("title").length)
            document.write(" Note: The title element did end up in the document.");
        else
            document.write(" Note: The title element did not end up in the document.");
    </script>
</body>