Not sure how to reliably reproduce this, but I was looking at the bug url, to see if there was anyway I could possibly reduce the reduction to not rely on external javascript resources (a futile attempt - there's too much javascript there, and I don't know much about the language). I stepped through the code for a while, then a slow script dialog came up, which I dismissed, then I told it to stop debugging, and it crashed. Tested with r35904. Crash log coming. Based on the crash log, looks similar to bug 20480 and bug 20493
Created attachment 22969 [details] crash log
<rdar://problem/6172324>