The minimal variant with which I repeated the crash was:

    <style type="text/css">
        #a { margin: 0 10px 10px; }
        #b { width: 100%; }
    </style>
    <table>
        <tr>
            <td>
                <div id="a">
                   <form id="b">
                   <input type="text" name="test"/>
                </div>
            </td>
            <td width="1">
            </td>
        </tr>
    </table>

Removing the second td is enough to make the html not crashing on IE 9. The "crash" manifests itself in some kind of an infinite loop (one thread jumps to 100% CPU and stays so). Then the "recovery" mechanisms kick in, reloading the page, blocking again... :) Can anybody reduce it even more?

It was just: <input type crash> as I recall - not specifying a value for type.