Created attachment 594583 [details]
2. Click in the box where it says "here are rabbit-warrens..."
3. ASSERT|ABORT Beta/11, Aurora/12, Nightly/13 Linux and Mac at least.
###!!! ASSERTION: aForFrame not found in block, someone lied to us: 'isValid', file /work/mozilla/builds/nightly/mozilla/layout/generic/nsTextFrameThebes.cpp, line 1213
###!!! ABORT: comparing iterators over different lists: 'mListLink == aOther.mListLink', file /work/mozilla/builds/nightly/mozilla/layout/base/../generic/nsLineBox.h, line 724
Crashes Mac Aurora nightly at least but I can't get a crash reporter dialog to come up there though Beta does.
Bug 638937 has similar symptoms and smaller testcases.
The patch in bug 638937 appears to fix this crash also.