The exception is bogus (reported as bug 144227). Lets try to work around it by not using a custom property on a DOM wrapper.
<rdar://problem/20702093>
Created attachment 251697 [details] Patch
Comment on attachment 251697 [details] Patch r=me
Comment on attachment 251697 [details] Patch Clearing flags on attachment: 251697 Committed r183425: <http://trac.webkit.org/changeset/183425>
All reviewed patches have been landed. Closing bug.