mozilla-release/gfx/tests/crashtests/594654-1.xhtml

<html xmlns="http://www.w3.org/1999/xhtml">
<body onload="document.getElementById('x').appendChild(document.createElementNS('http://www.w3.org/1998/Math/MathML', 'mrow'));">
<div style="position: fixed;"><div><msubsup xmlns="http://www.w3.org/1998/Math/MathML" id="x"/></div><menclose xmlns="http://www.w3.org/1998/Math/MathML"/></div><mroot xmlns="http://www.w3.org/1998/Math/MathML"/>
</body>
</html>