Sure, we all know programs have bugs, and web browsers are programs, so bugs are bound to be there. I guess I'm lucky (or unlucky) to be the one that finds one.
So basically, this bug stems from trying to select() a text input that was orginally inside a hidden div, that was later exposed. Below is a very simple html/css/js example that demonstrates the flaw. I've also included a link to the same example, just in case you want to see it for your self. It uses jquery, but it could probably just as easily have been written with vanilla javascript, but I don't have the time to try and convert it (read, I tried quickly, and it didn't cause the crash, so I left it using jquery).
Without further ado, the code:
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>Make safari go boom!</title>
<style>
.hidden { display: none; }
</style>
<script type="text/javascript" src="http://ajax.googleapis.com/ajax/libs/jquery/
1.3.2/jquery.min.js"></script>
<script type="text/javascript">
$(document).ready( function() {
$('#input').bind('focus', function() {
$(this).select();
});
$('#boom').click( function() {
$('#container').toggleClass('hidden');
$('#input').focus();
});
$('#container').removeClass('hidden');
});
</script>
</head>
<body>
<div id="container" class="hidden" >
<input type="text" value="Some default text" id="input" />
</div>
<input type="submit" value="Go Boom" id="boom" />
</body>
</html>
And the example to make Safari 4 go boom!
UPDATE: This appears to be fixed now in safari 5.
