michael@0: <window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
michael@0:         onload="document.getElementById('trigger');">
michael@0:   <box style="display: none">
michael@0:     <bindings xmlns="http://www.mozilla.org/xbl">
michael@0:       <binding id="crash">
michael@0:         <implementation>
michael@0:           <constructor>
michael@0:             // Fetch it
michael@0:             var obj = this.getElementsByTagName("box")[0];
michael@0:             // And make it preserve its wrapper.  Note that this will happen
michael@0:             // while we're wrapping our box as the parent for id="trigger",
michael@0:             // so then we'll unwind and things will be bad.
michael@0:             if (obj) obj.expando = 5;
michael@0:           </constructor>
michael@0:         </implementation>
michael@0:       </binding>
michael@0:     </bindings>
michael@0:     <box style="-moz-binding:url(#crash);">
michael@0:       <box id="trigger"/>
michael@0:     </box>
michael@0:   </box>
michael@0:   <!-- Make sure we load our XBL before we try to run our test -->
michael@0:   <box style="-moz-binding:url(#crash);"/>
michael@0: </window>