The ScriptValue m_detail in the CustomEvent class is initialized to null (rather than jsNull()) which can lead to a null deref if it is access before calling initCustomEvent. javascript:alert(document.createEvent("CustomEvent").detail) should do the trick.
It does, it does! Repro crash -> P1
Created attachment 99737 [details] Patch
<rdar://problem/9724577>
Committed r90405: <http://trac.webkit.org/changeset/90405>