HandleStartElement() calls nsXMLContentSink::PushNameSpacesFrom(), but if aAtts is empty and we already have name space stack, we end up duplicating the last namespace. Patch coming up.
Hmm... it seems I was a bit too hasty to file this bug. We seem to want to duplicate the last namespace because pop relies on that. Maybe this is not the most elegant solution, but it works right now so I'll just leave it as is. Marking as INVALID.