<html>
<head>
<script>
 
function boo()
{
  var rect = document.createElementNS("http://www.w3.org/2000/svg", "rect");
  rect.setAttribute("stroke", "blue");

  document.body.appendChild(rect);
}
 
</script>
</head>

<body class="bodytext" onload="boo();">

<div id="c1"></div>

<p>In a debug trunk build from 2006-006-27, loading this page triggers an assertion.  (It also triggers a CSS error in the console, but I think that's a known, separate bug.)</p>

</body>
</html>