In HTMLTemplateElement.cpp near line 214:
Element* element = m_template->treeScope()->getElementById(m_template->fastGetAttribute(refAttr));
This does not work correctly since we might need to check both the ownerDocument of the template element as well as the template contents owner
Maybe an example will show what I mean.
<template id=a>...</template>
<template>
<template id=b>...</template>
<template ref=a>...</template>
<template ref=b>...</template>
</template>
Also see https://code.google.com/p/mdv/source/browse/template_element.js#510