If a table is fixed layout and and it's children are set to display:none, corrupts the heap (FixedTableLayout.cpp:288).
Created attachment 19363 [details]
Corrupts heap. Hits assert in debug mode.
Heap corruption is a potential security issue but not flagging as such since we don't have an exploit.
Fixed in r30716.