<html>
<head>
<script>

// Document must not have a doctype to trigger the bug

function boom()
{
  var root = document.documentElement;
  while (root.firstChild) { root.removeChild(root.firstChild); }
  root.contentEditable = "true";
  document.removeChild(root);
  document.appendChild(root);
  window.getSelection().collapse(root, 0);
  window.getSelection().extend(document, 1);
  document.removeChild(root);
}

</script>
</head>

<body onload="boom();"></body>
</html>