The Tor Browser: diff content/base/crashtests/493281-2.html

     1.1 --- /dev/null	Thu Jan 01 00:00:00 1970 +0000
     1.2 +++ b/content/base/crashtests/493281-2.html	Wed Dec 31 06:09:35 2014 +0100
     1.3 @@ -0,0 +1,12 @@
     1.4 +<html>
     1.5 +    <body>
     1.6 +        <div id="foo">
     1.7 +            <script>
     1.8 +                function get(x) { return x }
     1.9 +                obj = {};
    1.10 +                obj.__proto__ = get(document.all);
    1.11 +                obj.foo
    1.12 +            </script>
    1.13 +        </div>
    1.14 +    </body>
    1.15 +</html>

The Tor Browser / file diff

diff: content/base/crashtests/493281-2.html

content/base/crashtests/493281-2.html