Crash test suite

This suite loads a frame, stores a reference to one of its elements, then reloads that frame (delayed) and then replaces the frame set containing that frame. For an unknown reason the old frame remains in a zombie state, it is possible to load web pages into it. Even more weird, when launching a popup dialog from that frame, previously launched popup windows get overwritten - including chrome windows (e.g. browser properties).

Sometimes the browser crashes while doing this due to an attempt to dereference a function pointer on a freed object. Here this should just crash the browser; although it seems to be impossible to me right now there might be the chance of executing arbitrary code that way.

In order to use this put all pages onto perl enabled web space (required for the delay.pl script to work).

Click here to start (warning: your browser might crash)