It has been stated:
A major problem with simple approaches to increasing the Bitcoin blocksize is that for certain transactions, signature-hashing scales quadratically rather than linearly.
https://bitcoincore.org/en/2016/01/26/segwit-benefits/#linear-scaling-of-sighash-operations
What are some examples of transactions with this behavior, and what do they have in common?
Does a simple one-input-two-output Alice-pays-Bob transaction show quadratic signature-hashing scaling?