Not sure if this is useful or not, but I experienced a crash with the latest build (r35177), though have not been able to reproduce it. I had about 25 tabs open at the time, and even reopening those 25 tabs does not reproduce it. The log is here really for the sake of posterity more than anything else.
Created attachment 22286 [details] crash log crash log
Top of stack trace for easier searching: Thread 0 Crashed: 0 com.apple.JavaScriptCore 0x003d0622 KJS::Profiler::didExecute(KJS::ExecState*, KJS::UString const&, int) + 50 1 com.apple.JavaScriptCore 0x003baf6d KJS::Machine::unwindCallFrame(KJS::ExecState*, KJS::JSValue*, KJS::Instruction const*&, KJS::CodeBlock*&, KJS::JSValue**&, KJS::ScopeChainNode*&, KJS::Register*&) + 413 2 com.apple.JavaScriptCore 0x003bb782 KJS::Machine::throwException(KJS::ExecState*, KJS::JSValue*, KJS::Instruction const*, KJS::CodeBlock*&, KJS::JSValue**&, KJS::ScopeChainNode*&, KJS::Register*&) + 274 3 com.apple.JavaScriptCore 0x003bc430 KJS::Machine::privateExecute(KJS::Machine::ExecutionFlag, KJS::ExecState*, KJS::RegisterFile*, KJS::Register*, KJS::ScopeChainNode*, KJS::CodeBlock*, KJS::JSValue**) + 2272 4 com.apple.JavaScriptCore 0x003c4aa2 KJS::Machine::execute(KJS::ProgramNode*, KJS::ExecState*, KJS::ScopeChainNode*, KJS::JSObject*, KJS::JSValue**) + 402 5 com.apple.JavaScriptCore 0x0036ce91 KJS::Interpreter::evaluate(KJS::ExecState*, KJS::ScopeChain&, KJS::UString const&, int, WTF::PassRefPtr<KJS::SourceProvider>, KJS::JSValue*) + 289 6 com.apple.WebCore 0x011e1578 WebCore::ScriptController::evaluate(WebCore::String const&, int, WebCore::String const&) + 232
It looks like you had the profiler running at the time. When you tried to duplicate your steps did you also turn the profiler back on? It will not turn on automatically. Also it appears an exception was thrown in JavaScript. Also please give this bug a more descriptive and informative title.
I had run the profiler, but about 30 minutes earlier. I run the profiler when running SunSpider, just out of interest. However, I haven't yet worked out how to actually see the profile data, as it doesn't actually show up anywhere (it showed up once, but I haven't worked out how to repeat it). I had shut the Inspector window at least 10-20 minutes before the crash actually occurred.