Test for bug 89496: Crash in RenderTableSection::addCell.

This test passes if it doesn't CRASH or ASSERT.