With Netscape 4.72 or 4.76 on Linux, loading cssbugdemo.html causes a bus error; gdb shows the following stack on Linux with NS4.76:
Program received signal SIGSEGV, Segmentation fault.
0x877e28c in JS_ConstructObject () from /usr/lib/netscape/plugins/libnullplugin.so
(gdb) bt
#0  0x877e28c in JS_ConstructObject () from /usr/lib/netscape/plugins/libnullplugin.so
#1  0x877e4d7 in JS_DefineProperty () from /usr/lib/netscape/plugins/libnullplugin.so
#2  0x87bc68d in LM_ReflectNamedAnchor () from /usr/lib/netscape/plugins/libnullplugin.so
#3  0x87b3542 in ET_SendImageEvent () from /usr/lib/netscape/plugins/libnullplugin.so
#4  0x8935116 in PR_HandleEvent () from /usr/lib/netscape/plugins/libnullplugin.so
#5  0x87b4f4d in et_SubEventLoop () from /usr/lib/netscape/plugins/libnullplugin.so
#6  0x87b4feb in lm_wait_for_events () from /usr/lib/netscape/plugins/libnullplugin.so
#7  0x893f94c in HopToad () from /usr/lib/netscape/plugins/libnullplugin.so
#8  0x893f98b in HopToadNoArgs () from /usr/lib/netscape/plugins/libnullplugin.so
#9  0x893f9f4 in PR_Start () from /usr/lib/netscape/plugins/libnullplugin.so
#10 0x0 in ?? () from /usr/lib/netscape/plugins/libnullplugin.so        
I have seen this occur on Win98, but only on a larger test case, and less reproducably.

See also