This is due to calling scope() on a hostFunction as a part of calling createPrototypeProperty to reify the prototype property. But host functions don't have a prototype property anyway!
Created attachment 99732 [details] The patch
Fixed in r90402
All tests are failing on Leopard, Win and Qt: http://build.webkit.org/results/Leopard%20Intel%20Debug%20(Tests)/r90436%20(32078)/accessibility/anchor-linked-anonymous-block-crash-crash-log.txt
They're all crashing in JSC. webkit-patch what-broke tells me this is the most likely change.
Actually, it may have been http://trac.webkit.org/changeset/90401.