Crash report: https://crash-stats.mozilla.org/report/index/d06eebb5-53e8-4227-9934-ee8d00210422

Reason: EXCEPTION_ACCESS_VIOLATION_READ

Top 10 frames of crashing thread:

0 xul.dll NS_CycleCollectorSuspect3 xpcom/base/nsCycleCollector.cpp:3759
1 xul.dll XULContentSinkImpl::Release dom/xul/nsXULContentSink.cpp:165
2 xul.dll nsImapMailCopyState::~nsImapMailCopyState comm/mailnews/imap/src/nsImapMailFolder.cpp:7611
3 xul.dll nsImapMailCopyState::~nsImapMailCopyState comm/mailnews/imap/src/nsImapMailFolder.cpp:7608
4 xul.dll mozilla::dom::`anonymous namespace'::FileCreationHandler::Release dom/base/BodyConsumer.cpp:436
5 xul.dll nsImapUrl::~nsImapUrl comm/mailnews/imap/src/nsImapUrl.cpp:76
6 xul.dll [thunk]: virtual void* __thiscall nsImapUrl::`vector deleting destructor' 
7 xul.dll nsMsgMailNewsUrl::Release comm/mailnews/base/src/nsMsgMailNewsUrl.cpp:80
8 xul.dll nsImapUrl::Release comm/mailnews/imap/src/nsImapUrl.cpp:80
9 xul.dll nsImapProtocol::~nsImapProtocol comm/mailnews/imap/src/nsImapProtocol.cpp:662

This crash looks like it is happening because a cycle collected object (XULContentSinkImpl) is being destroyed off the main thread.

These are all crashes you have experienced?
Can you reproduce?

I filed these bugs based on crash stats. NS_CycleCollectorSuspect3 was added to the prefix list, so the single signature was split up into a bunch of new signatures.

Cool. That confirms my thinking this is in the lineage of Bug 1586494 - Crash in [@ NS_CycleCollectorSuspect3] from nsImapMockChannel - and others like it ... for which we need a new bug report. Also consistent with "being destroyed off the main thread".

The root cause of all those signatures is likely the same.

This is fixed by smtp-js bug 1661694. See bug 1517464 comment 69 for details