Any javascript exception thrown from the callback to a string replacement will cause a crash. Catching the exception within the callback prevents the crash. This is a regression relative to Safari 3.1.2 The bug is present in r35203 and r36766.
<rdar://problem/6240812>
Created attachment 23739 [details] patch
Committed revision 36842.