While I cannot reproduce this crash in "safe mode", I have disabled all of my extensions and crash while visiting amazon.com. Seems like a tracer/jquery issue. This is my own build from an hg pull --update from yesterday afternoon: hg log changeset: 37880:5ea413d845bf tag: tip user: Boris Zbarsky <bzbarsky@mit.edu> date: Wed Feb 03 16:17:55 2010 -0500 summary: Bug 540531. Freeze the refresh driver when a page goes into bfcache. r=dbaron gdb bt output is attached as well as output from call DumpJSStack()

for the record, a normal up-to-date nightly build is not crashing when I visit amazon, or in particular, this page: http://www.amazon.com/gp/product/B001J31HDG/ref=s9_simi_gw_p60_i3?pf_rd_m=ATVPDKIKX0DER&pf_rd_s=center-2&pf_rd_r=19X9G57DSAV7NE5DTXBG&pf_rd_t=101&pf_rd_p=470938631&pf_rd_i=507846

The assertion message points at the dup, I think.