These appear to all genuinely be NULL-dereferences. They're not crashes at other addresses disguised as NULL-dereferences (as per bug 1018360).
Created attachment 8476840 [details] prefs.js This is the prefs.js of a Mac user who had a startup crash with this signature even in safe mode. Crash: https://crash-stats.mozilla.com/report/index/71089a5e-844d-4892-bfa1-a7b502140821
Restricting access to this bug due to private details and parts of browser history in the file.
Hiding attachment and un-hiding the bug.