1) Open attachment 2) Click on Show Results (used to be a search form) Apologies for a not-that-reduced testcase. Removing too much from form caused it to stop crashing, and was not in mood to reduce it further by hand after many many crashes.
Created attachment 23532 [details] Demo of crasher
Confirmed with a local debug build. The crash itself is deep in Safari FormCompletionController, but since it only happens with current WebKit, it is likely a WebKit bug.
Might be fixed in <http://trac.webkit.org/projects/webkit/changeset/36692>.
Testcase no longer crashes in r36712 nightly, which makes your r36692 theory likely.