file_bug650273.html (774B)
1 <!-- test by moz_bug_r_a4@yahoo.com --> 2 <body onload="a()"> 3 <script> 4 var targetUrl = "http://example.com/"; 5 var l; 6 7 function a() { 8 var o = {}; 9 o.toString = function() { 10 l(); 11 return "a"; 12 }; 13 var f = Object.getOwnPropertyDescriptor(Document.prototype, "title").set; 14 setTimeout(f.bind(document), 0, o); 15 } 16 17 function l() { 18 var l = false; 19 onunload = function() { 20 l = true; 21 }; 22 location = targetUrl; 23 do { 24 var r = new XMLHttpRequest(); 25 r.open("GET", location.href, false); 26 r.overrideMimeType("text/plain"); 27 try { r.send(null); } 28 catch (e) {} 29 } while (!l); 30 } 31 </script>