Bug 1539518 helped me see that BrowserTabList object is leaked after the toolbox is closed and the actors are all destroyed.

https://searchfox.org/mozilla-central/rev/2738efcf98d746c8810819e7c0634b2c57212a8d/devtools/server/actors/webbrowser.js#153

This leaks because the root actor tries to unregister it from here:
https://searchfox.org/mozilla-central/rev/2738efcf98d746c8810819e7c0634b2c57212a8d/devtools/server/actors/root.js#205

      this._parameters.tabList.onListChanged = null;

But the following code will force registering a listener instead of unregistering it:
https://searchfox.org/mozilla-central/rev/2738efcf98d746c8810819e7c0634b2c57212a8d/devtools/server/actors/webbrowser.js#445-448

  /* If we have live actors, we need to be ready to mark them dead. */
  this._listenForEventsIf(this._actorByBrowser.size > 0,
                          "_listeningForTabClose",
                          ["TabClose", "TabRemotenessChange"]);

That's because this._actorByBrowser still contains all actors to which we connected. We do not try to clear this Map anywhere on destroy.

I'll land this patch only after bug 1541819 landed on m-c for a couple of days.

BrowserTabList._actorByBrowser still contains opened tab we attached
to when destroying the RootActor. This prevents correctly unregistering
the DOM listener set on browser.xul, leading to permanent leaks.

https://hg.mozilla.org/mozilla-central/rev/696aa652a9e1