According to TB there are some crashes @ nsCSubstring::Assign. The latest stack traces have always metrics.dll just before the crash. Is that THE metrics, or some 3rd party library?
Smaug, did you examine Firefox crashes or Thunderbird? In a modest sampling of nsCSubstring::Assign crashes (i.e. 10 of 100), I found none with metrics.dll
I don't think this is the metrics extension since we do not ship it. Google toolbar might ship something like it... but that would be just for Firefox (afaik)
still valid? xref Bug 408604
crash-stats shows zero crashes [@ nsCSubstring::Assign] in the last week.