Steps to reproduce: Tries to execute custom code. As soon as Firefox crashes, look in your C: drive, you'll find a file named "proof.of.exploit" there if it works as expected. If you cannot reproduce: close firefox, start firefox again, load testcase If it still doesn't work: save testcase to disk, right click, run in firefox This requires Firefox 1.8.0.4: 2006050817 (probably it works with the German version only)