palemoon-dev/platform/layout/xul/crashtests/432068-2.xul

<?xml version="1.0"?>

<?xml-stylesheet href="chrome://global/skin/" type="text/css"?>

<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" onload="boom();">

<script type="text/javascript">

function boom()
{
  var l = document.createElementNS("http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul", "listitem");
  l.style.display = "none";

  var c = document.getElementById("c");
  c.parentNode.insertBefore(l, c);
  
  document.getElementById("listbox").removeChild(document.getElementById("c"));
}

</script>

<listbox id="listbox"><listitem/><listitem id="c"/></listbox>

</window>