The funniest one is an auto correct bug. If you make a text area that is limited to n characters, and auto correct changes the word you are typing to be n + 1 characters Safari completely crashes. I learned this one several times filling out a very long web form and just gave up and moved to Chrome.
I bet there's multiple issues in the text input / autocorrect buffer bounds checking. It's possibly an exploitable security issue too, or at least a nice area for research.
