diff --git a/Tests/LibWeb/Text/expected/navigation/history-replace-push-state-race.txt b/Tests/LibWeb/Text/expected/navigation/history-replace-push-state-race.txt
new file mode 100644
index 0000000000..173c92ab80
--- /dev/null
+++ b/Tests/LibWeb/Text/expected/navigation/history-replace-push-state-race.txt
@@ -0,0 +1 @@
+test done!
diff --git a/Tests/LibWeb/Text/input/navigation/history-replace-push-state-race.html b/Tests/LibWeb/Text/input/navigation/history-replace-push-state-race.html
new file mode 100644
index 0000000000..c735487f47
--- /dev/null
+++ b/Tests/LibWeb/Text/input/navigation/history-replace-push-state-race.html
@@ -0,0 +1,16 @@
+<script src="../include.js"></script>
+<script>
+    asyncTest(done => {
+
+        history.replaceState({}, "hello", "history-replace-push-state-race.html");
+        history.replaceState({}, "hello", "history-replace-push-state-race.html");
+
+        // this test checks a regression for a crash in `finalize_a_same_document_navigation`
+        // when `target_navigable->get_session_history_entries()` does not contain `entry_to_replace` exactly.
+        //
+        // history.replaceState is one possible trigger for the crash.
+
+        println("test done!");
+        done();
+    });
+</script>
diff --git a/Userland/Libraries/LibWeb/HTML/Navigable.cpp b/Userland/Libraries/LibWeb/HTML/Navigable.cpp
index dc0d8b5f84..be3d373d5d 100644
--- a/Userland/Libraries/LibWeb/HTML/Navigable.cpp
+++ b/Userland/Libraries/LibWeb/HTML/Navigable.cpp
@@ -1877,6 +1877,9 @@ void perform_url_and_history_update_steps(DOM::Document& document, AK::URL new_u
         // 1. Finalize a same-document navigation given traversable, navigable, newEntry, and entryToReplace.
         finalize_a_same_document_navigation(*traversable, *navigable, new_entry, entry_to_replace);
     });
+
+    // FIXME: Implement synchronous session history steps.
+    traversable->process_session_history_traversal_queue();
 }
 
 void Navigable::scroll_offset_did_change()
diff --git a/Userland/Libraries/LibWeb/HTML/NavigableContainer.cpp b/Userland/Libraries/LibWeb/HTML/NavigableContainer.cpp
index d34c9a10ad..49ce5f7471 100644
--- a/Userland/Libraries/LibWeb/HTML/NavigableContainer.cpp
+++ b/Userland/Libraries/LibWeb/HTML/NavigableContainer.cpp
@@ -214,9 +214,6 @@ Optional<AK::URL> NavigableContainer::shared_attribute_processing_steps_for_ifra
     // 4. If url matches about:blank and initialInsertion is true, then perform the URL and history update steps given element's content navigable's active document and url.
     if (url_matches_about_blank(url) && initial_insertion) {
         perform_url_and_history_update_steps(*m_content_navigable->active_document(), url);
-        // NOTE: Not in the spec but we need to make sure that "apply the history step" for initial navigation to about:blank
-        //       is applied before subsequent navigation.
-        navigable()->traversable_navigable()->process_session_history_traversal_queue();
     }
 
     // 5. Return url.