Confirming bug with Mozilla trunk binary 20020924xx on WinNT. This has something to do with document.write(), because if we replace it in the testcase with alert(), we do not see the bug. Reassigning to DOM Level 0 -
Um... document.write in the onload handler (after the document has finished loading) implicitly calls document.open() and thus wipes out the old document and therefore the old script context (clearing the JS scope in the process). We already have bugs on this; not sure whether they're resolved (invalid, wontfix, etc) or not.
*** Bug 170907 has been marked as a duplicate of this bug. ***
Duplicate of bug 114461 - "document.open clobbers js context" *** This bug has been marked as a duplicate of 114461 ***