After bug 21364 is resolved, we can do this.
Created attachment 24130 [details] Proposed patch
Created attachment 24137 [details] Revised proposed patch This fixes the crash. It was a problem with the ScopeChain dereffing in unwindCallFrame().
Comment on attachment 24137 [details] Revised proposed patch r=me, but i'd like a bug to cover the absence of documentation on op_tear_off_activation and op_enter_with_activation
Landed in r37366.