Created attachment 266816 [details]
the test case: crashes MacOS 1_8 branch, makes Windows 1_8 branch unresponsive.
Using DOM mutation events it is possible to crash the browser or make the UI unresponsive.
See also bug 382568, bug 382681, bug 382700, bug 355548;
Fixed by the patch in bug 382681.
No hang or crash using Thunderbird version 22.214.171.124 (20070809) with JS enabled. Replacing fixed126.96.36.199 keyword with verified188.8.131.52.