This appears to be caused by the DFG CFG simplification phase trying to fixup GetLocals that have already been fixed up, leading to bizarre behavior.
Reviewed in person by Geoff.
Landed in http://trac.webkit.org/changeset/120148