The Tor Browser / file revision

 <?xml version="1.0"?>

 <?xml-stylesheet href="chrome://global/skin" type="text/css"?>

 <window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">

 <script type="text/javascript">

 <![CDATA[

 function boom()

 {

   var x = document.getElementById("x");

   x.appendChild(document.createTextNode("A"));

   x.appendChild(document.createTextNode("\u202B" + "C"));

   document.getBoxObjectFor(document.documentElement).height; // flush layout

   x.normalize();

   x.appendChild(document.createTextNode("D"));

 }

 window.addEventListener("load", boom, false);

 ]]>

 </script>

 <box id="x" style="display:inline"><box/></box>

 </window>