crashing build 2003072104 on Win2k, will post TB ID or stack trace. Look very similar to bug 212338.
In the meantime, reassigning to Browser-General until we can get a stack trace. Not likely to be a JS Engine issue. Confirming bug based on Olivier's findings -
Created attachment 128256 [details] Camino crash log Seeems to be a problem on the mac platform as well. With Camino 2003071004 on Mac OS 10.1.5 the testcase makes the browser hang. The system generates a crash log though.
Probably a dup of that other crash bug with form controls (accessing invalid primary frame hash entries).
stack from attachment 127480 [details] is identical. *** This bug has been marked as a duplicate of 212338 ***