<html xmlns="http://www.w3.org/1999/xhtml">
<head>

<bindings xmlns="http://www.mozilla.org/xbl">
  <binding id="g">
    <implementation>
      <constructor>
        throw 3;
      </constructor>
    </implementation>
  </binding>
</bindings>

<script type="text/javascript">

function e()
{
  var listboxbody = document.createElementNS("http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul", "listboxbody");
  document.getElementById("s").appendChild(listboxbody);
}

</script>
</head>

<body onerror="e();"><span id="s" style="-moz-binding: url(#g)"></span></body>

</html>