<body>
<script>
if (window.testRunner)
    testRunner.dumpAsText();

var ifr = document.createElement('iframe');
ifr.setAttribute('src', 'javascript:parent.boom(), "<div>Crash?</div>"');
document.body.appendChild(ifr);

function boom() {
    document.body.removeChild(ifr);
}
</script>
This test passes if it doesn't crash.