<!DOCTYPE html>
<p>You should see the word PASS below, and no crash.</p>
<p id="p">FAIL</p>
<script>
    p.offsetTop;
    p.innerHTML = "&nbsp;<form><select multiple><option selected></option></select><input max=1 min=1 type=number></form>";
    p.innerHTML = "PASS";
</script>