Let them eat crashtests.
new file mode 100644
--- /dev/null
+++ b/content/xbl/crashtests/368641-1.xhtml
@@ -0,0 +1,22 @@
+<html xmlns="http://www.w3.org/1999/xhtml"
+ xmlns:xul="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+
+<head>
+<script>
+
+function boom()
+{
+ var yaz = document.getElementById("yaz");
+
+ document.body.appendChild(yaz);
+}
+
+</script>
+</head>
+
+<body onload="boom()">
+
+ <xul:tabs><span id="yaz"><xul:hbox><xul:popup/><xul:template/></xul:hbox></span></xul:tabs>
+</body>
+
+</html>
--- a/content/xbl/crashtests/crashtests.list
+++ b/content/xbl/crashtests/crashtests.list
@@ -1,3 +1,4 @@
load 368276-1.xhtml
+load 368641-1.xhtml
load 382376-1.xhtml
load 382376-2.xhtml
