<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
        onload="document.getElementById('trigger');">
  <box style="display: none">
    <bindings xmlns="http://www.mozilla.org/xbl">
      <binding id="crash">
        <implementation>
          <constructor>
            // Fetch it
            var obj = this.getElementsByTagName("box")[0];
            // And make it preserve its wrapper.  Note that this will happen
            // while we're wrapping our box as the parent for id="trigger",
            // so then we'll unwind and things will be bad.
            if (obj) obj.expando = 5;
          </constructor>
        </implementation>
      </binding>
    </bindings>
    <box style="-moz-binding:url(#crash);">
      <box id="trigger"/>
    </box>
  </box>
  <!-- Make sure we load our XBL before we try to run our test -->
  <box style="-moz-binding:url(#crash);"/>
</window>