LayoutTests/editing/inserting/insert-with-mutation-event.html

<!DOCTYPE html>
<body>
<div id="sample" contenteditable="true">
foo
<div id="test" style="font-weight:bold">bar</div>
</div>
</body>
<script>
if (window.testRunner)
    testRunner.dumpAsText();
function $(id) { return document.getElementById(id); }
window.getSelection().collapse($('test'), 0);
document.execCommand('Delete');
var sample = $('sample');
sample.addEventListener('DOMSubtreeModified', function () {
    // Move nodes being processed by 'InsertText' to another document.
    var anotherDoc = document.implementation.createDocument('', null);
    anotherDoc.adoptNode(sample);
});
document.execCommand('InsertText', false, 'ab123cd');
document.body.textContent = 'PASS; NOT CRASHED';
</script>