dom/base/crashtests/493281-2.html


1
2
3
4
5
6
7
8
9
10
11
12

<html>
    <body>
        <div id="foo">
            <script>
                function get(x) { return x }
                obj = {};
                obj.__proto__ = get(document.all);
                obj.foo
            </script>
        </div>
    </body>
</html>