This is a nasty crasher.
Created attachment 48643 [details] patch
Comment on attachment 48643 [details] patch Clearing flags on attachment: 48643 Committed r54725: <http://trac.webkit.org/changeset/54725>
All reviewed patches have been landed. Closing bug.