Created attachment 266816 [details]
the test case: crashes MacOS 1_8 branch, makes Windows 1_8 branch unresponsive.
Using DOM mutation events it is possible to crash the browser or make the UI unresponsive.
See also bug 382568, bug 382681, bug 382700, bug 355548;
Fixed by the patch in bug 382681.
No hang or crash using Thunderbird version 18.104.22.168 (20070809) with JS enabled. Replacing fixed22.214.171.124 keyword with verified126.96.36.199.