1. Run Firefox under Valgrind. 2. Enable accessibility, e.g. by pasting the following into the js console Components.classes["@mozilla.org/accessibilityService;1"] .getService(Components.interfaces.nsIAccessibleRetrieval); 3. Load the testcase Result: ==25415== Conditional jump or move depends on uninitialised value(s) ==25415== at 0x5B4F198: nsXULElement::IsFocusable(int*, int) (nsXULElement.cpp:577) ==25415== Uninitialised value was created by a stack allocation ==25415== at 0x5B4F140: nsXULElement::IsFocusable(int*, int) (nsXULElement.cpp:533) I think it's saying that the local variable "disabled" is not initialized, but I don't understand why that would happen. 575 PRBool disabled; 576 xulControl->GetDisabled(&disabled); 577 if (disabled) {

Looks like GetDisabled ends up throwing in this case (some XPConnect error code), presumably due to: JavaScript error: chrome://global/content/bindings/radio.xml, line 269: doc.getElementsByAttribute is not a function That happens because xul radiogroups apparently expect to be in a XUL document, and this one isn't. This seems like a core XUL bug to me. The reason accessibility is involved is that it wants to know whether things are focusable, so calls IsFocusable. If anything else made such a call on a <xul:radiogroup> in a non-XUL document, you'd get the same issue.

Oh, and fixing is trivial if we can decide whether an exception from GetDisabled should mean "yes" or "no".....