We crash in viewer and apprunner with the following stack: nsCParserNode::GetKeyAt(unsigned int 2) line 250 + 3 bytes CreateContentObject(const nsIParserNode & {...}, nsHTMLTag eHTMLTag_img, nsIDOMHTMLFormElement * 0x00000000, nsIWebShell * 0x01530b10, nsIHTMLContent * * 0x0012fbd0) line 800 + 18 bytes SinkContext::AddLeaf(const nsIParserNode & {...}) line 1079 + 35 bytes HTMLContentSink::AddLeaf(HTMLContentSink * const 0x03d0d4b0, const nsIParserNode & {...}) line 1979 + 15 bytes CNavDTD::AddLeaf(const nsIParserNode & {...}) line 2465 + 31 bytes CNavDTD::HandleDefaultStartToken(CToken * 0x0145b590, nsHTMLTag eHTMLTag_img, nsIParserNode & {...}) line 985 + 12 bytes CNavDTD::HandleStartToken(CToken * 0x0145b590) line 1181 + 25 bytes NavDispatchTokenHandler(CToken * 0x0145b590, nsIDTD * 0x0169b630) line 243 + 12 bytes CTokenHandler::operator()(CToken * 0x0145b590, nsIDTD * 0x0169b630) line 80 + 14 bytes CNavDTD::HandleToken(CNavDTD * const 0x0169b630, CToken * 0x0145b590, nsIParser * 0x03d0b280) line 633 + 18 bytes CNavDTD::BuildModel(CNavDTD * const 0x0169b630, nsIParser * 0x03d0b280, nsITokenizer * 0x0169bf80, nsITokenObserver * 0x00000000, nsIContentSink * 0x03d0d4b0) line 501 + 20 bytes nsParser::BuildModel() line 847 + 34 bytes nsParser::ResumeParse(nsIDTD * 0x00000000) line 799 + 11 bytes nsParser::OnStopBinding(nsParser * const 0x03d0b284, nsIURL * 0x03d2b520, unsigned int 0, unsigned short * 0x03ccaf10) line 1026 + 17 bytes nsDocumentBindInfo::OnStopBinding(nsDocumentBindInfo * const 0x03d2b3d0, nsIURL * 0x03d2b520, unsigned int 0, unsigned short * 0x03ccaf10) line 1986 + 30 bytes OnStopBindingProxyEvent::HandleEvent(OnStopBindingProxyEvent * const 0x03ccaec0) line 591 + 45 bytes StreamListenerProxyEvent::HandlePLEvent(PLEvent * 0x03ccaec4) line 471 + 12 bytes PL_HandleEvent(PLEvent * 0x03ccaec4) line 476 + 10 bytes PL_ProcessPendingEvents(PLEventQueue * 0x012ef4c0) line 437 + 9 bytes _md_EventReceiverProc(void * 0x021e03d8, unsigned int 49456, unsigned int 0, long 19854528) line 799 + 9 bytes USER32! 77e71250()

Moving over QA contacts and cc list from bug 3413...

Fixed by late-night update in parser which corrected token recycler bug.

Verified this bug, and there is no crash now.