Bug 346787 landed the support for the XUL spellcheck attribute on textbox elements. I can't tell if it used to somehow work at that time, but it definitely doesn't work now. That is, no red underline appears for misspelled words, and the spell checking specific context menu entries also do not work.

This is just a matter of the spellchecking code requiring privileged access. Spellchecking works ok for both single and multiline textboxes in chrome. I suspect in an unprivileged content window, the multiline textbox is just defaulting to spellchecking enabled. In fact, not setting spellcheck="true" still enables the underlining but not the context menu.