><bdi id=test1><refa id=test2>嵐>></bdi>><h1 id=test3><script> document.addEventListener("DOMContentLoaded", CFcrash, false); function CFcrash() { test1.setAttribute("dir", "invalid"); test2.textContent = " S "; test3.appendChild(test1); }</script>