<html> <head> <script> function boom() { window.addEventListener("DOMSubtreeModified", function(){}, false); var m = document.createElementNS("http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul", "menuitem"); document.body.appendChild(m); m.setAttribute("type", "checkbox"); m.setAttribute("checked", "true"); m.removeAttribute("type"); } </script> </head> <body onload="boom();"></body> </html>