chromium/third_party/blink/web_tests/plugins/reattach-plugin-during-access.html

<!DOCTYPE html>
<script>
if (window.testRunner)
  testRunner.dumpAsText();

onload = function() {
  divElem.appendChild(objElem);
  objElem[''] = 42;
}
</script>
<div id='divElem'></div>
<object id='objElem' type="text/javascript"></object>
<p>Test passes if it doesn't crash</p>