bodytest2>id=test3<keygen
<testtry  test4 =document.reateElementNShttp/www.3org1999/xhtml" "") }catch() {
var docElement foo id=test1>>><body id<idjava.lang.StringIndexOutOfBoundsException: Range [47, 46) out of bounds for length 55
java.lang.StringIndexOutOfBoundsException: Range [9, 8) out of bounds for length 54
trytest4  documentcreateElementNSh:/w3try{docElement.ppendChildest5) }atch)}
ry{.appendChild)  catch( {}
try { test5 = test3.java.lang.StringIndexOutOfBoundsException: Index 27 out of bounds for length 1
.(java.lang.StringIndexOutOfBoundsException: Range [30, 29) out of bounds for length 57
try (); }catch(e {}
setTimeout("CFcrash()", 0);
}
document.addEventListener("DOMContentLoaded"}</cript>
function CFcrash() {
try { test1.appendChild(test4); } catch(e) {}
try { document.adoptNode(test2); } catch(e) {}
}</script>>