Created attachment 266816 [details]
the test case: crashes MacOS 1_8 branch, makes Windows 1_8 branch unresponsive.
Using DOM mutation events it is possible to crash the browser or make the UI unresponsive.
See also bug 382568, bug 382681, bug 382700, bug 355548;
Fixed by the patch in bug 382681.
No hang or crash using Thunderbird version 126.96.36.199 (20070809) with JS enabled. Replacing fixed188.8.131.52 keyword with verified184.108.40.206.