This is due to calling scope() on a hostFunction as a part of calling createPrototypeProperty to reify the prototype property. But host functions don't have a prototype property anyway!
Created attachment 99732 [details]
Fixed in r90402
All tests are failing on Leopard, Win and Qt:
They're all crashing in JSC. webkit-patch what-broke tells me this is the most likely change.
Actually, it may have been http://trac.webkit.org/changeset/90401.