1. Visit http://www.rocket99.com/jscript/js26.html 2. Click on the "Menu Option A" link 3. Click on the "Menu Option B" link 4. Click the back button. You will hit an assert: FrameLoader.cpp:3939 recursiveGoToItem. m_previousHistoryItem is non-NULL when it is expected to be NULL. This assert seems bogus to me, but I don't really understand it's purpose. Tested with rev 19780 under Safari (using gdb-safari).
The backtrace I get from this ASSERT is the same as bug 12645 which was closed as a dupe of bug 6454. *** This bug has been marked as a duplicate of 6454 ***