michael@0: ><bdi id=test1><refa id=test2>&#xf921;>></bdi>><h1 id=test3><script>
michael@0: document.addEventListener("DOMContentLoaded", CFcrash, false);
michael@0: function CFcrash() {
michael@0: test1.setAttribute("dir", "invalid");
michael@0: test2.textContent = "	&#xf851;S	";
michael@0: test3.appendChild(test1);
michael@0: }</script>