With Netscape 4.72 or 4.76 on Linux, loading 
<a href="cssbugdemo.html">cssbugdemo.html</a> causes a
bus error; gdb shows the following stack on Linux with NS4.76:
<pre>
Program received signal SIGSEGV, Segmentation fault.
0x877e28c in JS_ConstructObject () from /usr/lib/netscape/plugins/libnullplugin.so
(gdb) bt
#0  0x877e28c in JS_ConstructObject () from /usr/lib/netscape/plugins/libnullplugin.so
#1  0x877e4d7 in JS_DefineProperty () from /usr/lib/netscape/plugins/libnullplugin.so
#2  0x87bc68d in LM_ReflectNamedAnchor () from /usr/lib/netscape/plugins/libnullplugin.so
#3  0x87b3542 in ET_SendImageEvent () from /usr/lib/netscape/plugins/libnullplugin.so
#4  0x8935116 in PR_HandleEvent () from /usr/lib/netscape/plugins/libnullplugin.so
#5  0x87b4f4d in et_SubEventLoop () from /usr/lib/netscape/plugins/libnullplugin.so
#6  0x87b4feb in lm_wait_for_events () from /usr/lib/netscape/plugins/libnullplugin.so
#7  0x893f94c in HopToad () from /usr/lib/netscape/plugins/libnullplugin.so
#8  0x893f98b in HopToadNoArgs () from /usr/lib/netscape/plugins/libnullplugin.so
#9  0x893f9f4 in PR_Start () from /usr/lib/netscape/plugins/libnullplugin.so
#10 0x0 in ?? () from /usr/lib/netscape/plugins/libnullplugin.so        
</pre>

I have seen this occur on Win98, but only on a larger test case, and
less reproducably.

<h2>See also</h2>
<ul>
<li><a href="http://sites.netscape.net/ekrockhome/crash.html">Netscape's 4.7x CSS crash report page</a>
<li> <a href="http://css.nu/pointers/bugs.html">CSS Bugs and Workarounds</a>
which lists two related crash bugs:
<ul>
<li>position: absolute applied in-line to a TABLE appears to crash any version of NN4.x (inluding 4.51)
<li>position: relative applied in-line to a DIV containing a table will crash the browser
</ul>
<li><a href="http://alistapart.zeldman.com/stories/fear4/">Fear of Stylesheets</a> at A List Apart
</ul>