LayoutTests/fast/parser/foreign-content-crash.html

<script>
    var svgElement = document.createElementNS("http://www.w3.org/2000/svg", "svg");
    svgElement.appendChild(document.createElement("div")).insertAdjacentHTML("beforeBegin", "</p>");

    if (window.testRunner)
        testRunner.dumpAsText();
</script>
<p>This test passes if it doesn't crash.</p>