diff --git a/content/base/crashtests/831287.html b/content/base/crashtests/831287.html
new file mode 100644
index 00000000000..3cd77fd2143
--- /dev/null
+++ b/content/base/crashtests/831287.html
@@ -0,0 +1,11 @@
+<head dir=auto id=test1><body id=test2><div" id=test3 itemtype=http://example.com/bar style="speak-numeral:> "><canvas id=c><p id=test4>FAIL (fallback content)</p></canvas>
+
+><script>
+document.addEventListener("DOMContentLoaded", CFcrash, false);
+function CFcrash() {
+test1.appendChild(test4);
+test1.setAttribute("dir", "foopy");
+test1.appendChild(c);
+test4.textContent = test2.outerHTML;
+c.appendChild(test3);
+}</script>>
\ No newline at end of file
diff --git a/content/base/crashtests/crashtests.list b/content/base/crashtests/crashtests.list
index 5ecb4cf1bfe..8b9025a6e98 100644
--- a/content/base/crashtests/crashtests.list
+++ b/content/base/crashtests/crashtests.list
@@ -130,6 +130,7 @@ load 827190.html
 load 828054.html
 load 829428.html
 load 830098.html
+load 831287.html
 load 832644.html
 load 836890.html
 load 838489-1.html
