<body>
Load <a href="http://www.google.com/">Google</a> and drag the logo onto this page. The second time you drag it on, Safari will crash.
<script>
function deleteSelection() {
document.execCommand("delete");
}
document.designMode="on";
document.body.addEventListener("DOMNodeInserted", deleteSelection, false);
</script>
</body>