This looks very similar (and possibly having the same solution) as bug 1523202. Looking at the crash stats, this seems to be hit with any type of a stream, so the problem is more general. crash rate is low, but according how the crash address looks, this seems to be exploitable.
Bug 1482084 Comment 10 Edit History
Note: The actual edited comment in the bug view page will always show the original commenter’s name and original timestamp.
This looks very similar (and possibly having the same solution) as bug 1523202. Looking at the crash stats, this seems to be hit with any type of a stream, so the problem is more general.