<!DOCTYPE html> <html> <head> <script type="text/javascript"> function boom() { var table = document.createElement("table"); document.body.appendChild(table); table.contentEditable = "true"; table.focus(); try { // This will throw, since it's attempting to inject a list inside a table document.execCommand("insertunorderedlist", false, null); } catch (e) {} } </script> </head> <body onload="boom();"></body> </html>