palemoon-dev/platform/layout/xul/tree/crashtests/414170-1.xul

<?xml version="1.0"?>

<?xml-stylesheet href="chrome://global/skin/" type="text/css"?>

<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
        onload="boom();">
        
<script type="text/javascript">

function boom()
{
  var option = document.createElementNS("http://www.w3.org/1999/xhtml", "option");
  document.getElementById("tc").appendChild(option);
}

</script>

<tree><treechildren id="tc"><hbox/></treechildren></tree>

</window>