I have not been able to catch it in a debugger, but there are numerous reports indicating a crash in WebCore::FrameView::setVisibleScrollerThumbRect(). Looks like we are de-referencing page. Patch forthcoming. <rdar://problem/9329253>
Created attachment 91423 [details] Patch
Thanks Dan! Committed fix with revision 85147.