1. Visit http://www.rocket99.com/jscript/js26.html
2. Click on the "Menu Option A" link
3. Click on the "Menu Option B" link
4. Click the back button.
You will hit an assert: FrameLoader.cpp:3939 recursiveGoToItem. m_previousHistoryItem is non-NULL when it is expected to be NULL. This assert seems bogus to me, but I don't really understand it's purpose.
Tested with rev 19780 under Safari (using gdb-safari).
The backtrace I get from this ASSERT is the same as bug 12645 which was closed as a dupe of bug 6454.
*** This bug has been marked as a duplicate of 6454 ***