third_party/WebKit/ManualTests/remove-on-drop-crash.html - chromium/src - Git at Google

 <body>
 Load <a href="http://www.google.com/">Google</a> and drag the logo onto this page.  The second time you drag it on, Safari will crash.
 <script>
 function deleteSelection() {
   document.execCommand("delete");
 }
 document.designMode="on";
 document.body.addEventListener("DOMNodeInserted", deleteSelection, false);
 </script>
 </body>
	<body>
	Load <a href="http://www.google.com/">Google</a> and drag the logo onto this page. The second time you drag it on, Safari will crash.
	<script>
	function deleteSelection() {
	document.execCommand("delete");
	}
	document.designMode="on";
	document.body.addEventListener("DOMNodeInserted", deleteSelection, false);
	</script>
	</body>