If a plugin removes itself from the DOM during the paint (via, say, a NPN_Evaluate()), the rendering code defers a NULL pointer and crashes. We're seeing this in the wild in the Chromium port surprisingly often.
Created attachment 42416 [details] LayoutTest that exhibits the behavior Attached is a layout test (and modifications to the TestNetscapePlugin) with a plugin that removes itself (by calling NPN_Evaluate() on a script that sets the plugin's parent's innerHTML to '') during paint. This causes a crash in RenderWidget.cpp. The problem is that setting innerHTML causes the previous child Node objects to be destroyed, which causes the associated renderers to be destroyed. The rendering code does not check for this case and dies.
Mass closing plug-in bugs, as plug-in support has been removed from WebKit. Please comment and/or reopen if this still affects WebKit in some way.