If creating the function for the toString property on event listeners fails an empty handle is used for the SetHiddenValue call. See: http://crbug.com/11734.
Created attachment 30188 [details] Patch to check for empty hadles.
Comment on attachment 30188 [details] Patch to check for empty hadles. r=me
Landed as http://trac.webkit.org/changeset/43566.