djoham - thanks for finding this! Here's a bug sleuthing trail, if you'd like to try some of these tools when filing future bugs - an lxr (http://lxr.mozilla.org) search for 'Replace' finds likely candidate nsLocation.cpp; and cvs blame (linked off the lxr page for nsLocation.cpp) shows the last person to modify LocationImpl::Replace as rickg. Reassigning to email@example.com.
Sorry -- but your script is wrong. We do exactly what IE and nav do.
Oh yes, the core dump appears to be gone too.