Type in javascript:console.trace() into address bar of Safari running ToT WebKit. Observe the crash.
Fix coming up.
This is now obsolete.