Created attachment 266816 [details]
the test case: crashes MacOS 1_8 branch, makes Windows 1_8 branch unresponsive.
Using DOM mutation events it is possible to crash the browser or make the UI unresponsive.
See also bug 382568, bug 382681, bug 382700, bug 355548;
Fixed by the patch in bug 382681.
No hang or crash using Thunderbird version 184.108.40.206 (20070809) with JS enabled. Replacing fixed220.127.116.11 keyword with verified18.104.22.168.