Crash in the hit testing code via HTMLPlugInElement::isReplacementObscured()