JSContext has a (copy) exceptionHandler property that it doesn't release in dealloc. That sounds like the potential for a leak. It should be released.
<rdar://problem/13111819>
Created attachment 185563 [details] Patch
Committed r141305: <http://trac.webkit.org/changeset/141305>