The recent form state change apparently caused a bunch of random memory trashers. Here's one set of steps that consistently reproduces a crash for me: 1) Go to http://www.cnn.com and wait for it to fully load. 2) Click any link. 3) Go back. Darin has a patch for this attached to a bug where this was misdiagnosed as the cause.
Darin's patch is attached to bug 8753.
Created attachment 8144 [details] patch based on Mitz's analysis
Created attachment 8145 [details] patch with improved change log
Comment on attachment 8145 [details] patch with improved change log r=me
People have been complaining about the crasher so I went ahead and commited this, hope you don't mind, Darin.
(In reply to comment #5) > People have been complaining about the crasher so I went ahead and commited > this, hope you don't mind, Darin. Not at all. I've been waiting on review or I would have committed a while back.