gecko-dev/dom/xml/crashtests/420429.xul

<?xml version="1.0"?>

<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
        onload="boom();">

<?xml-stylesheet?>

<script type="text/javascript">

function boom()
{
  window.addEventListener("DOMCharacterDataModified", function(){}, false);
  document.documentElement.cloneNode(true).getElementsByTagName("*").length;
}

</script>

</window>