Check out Fuzzing with DOM Level 2 and 3
Fuzzing techniques proved to be very effective in finding vulnerabilities in web browsers.
Over time several valuable fuzzers have been written and some of them (mangleme, cross_fuzz) have became a "de-facto" standard, being widely adopted by the security research community.
The most common approach in browser fuzzing leverages on DOM Level 1 interfaces, where DOM elements are randomly created, crawled, tweaked and deleted.
Using this approach hundreds of memory corruption bugs have been uncovered in all mainstream browsers but, due to widespread coverage, spotting new bugs is becoming increasingly difficult.
At DeepSec conference in Vienna, I showed an evolutive approach of browser fuzzing that relies on some DOM interfaces introduced by W3C DOM Level 2 and Level 3 specifications.
Using this approach a fuzzer prototype has been built and tested against IE9, IE10 and Chrome, providing interesting results: more than 70 different crashes have been generated and several memory corruption errors have been found, some of which turned to be exploitable."