-------------------------------------------------
Mozilla Firefox is prone to a D.O.S within its javascript Range object. In a
special condition, a NULL Pointer Deference occur and Firefox crashes.
From DOM MDC:

"The Range object represents a fragment of a document that can contain nodes
and parts of text nodes in a given document."

A Range object can be initialized using the selectNode method, that selects a
node to be inserted within a Range. A Range can also be used to create document
fragments using the createContextualFragment method. Below is an example of
using such a method, from DOM MDC:

As can be seen, a range is created using the createRange document method and
then is initialized using the selectNode method against some element within
the current document. At this point createContextualFragment can be used to
create document fragments, that can be inserted into the document.
Mozilla Firefox does not proper handle when a DOCUMENT_TYPE_NODE ( element is passed to selectNode method and trigger a NULL Pointer deference
when calling createContextualFragment method.

-------------------------------------------------
POC
-------------------------------------------------

This POC code crashes Mozilla Firefox: