(This bug doesn't exist on trunk until I land bug 322889, but I need a bug number assigned for a FIXME.) array_lookupProperty uses a per-object pigeonhole (JSSLOT_ARRAY_LOOKUP_HOLDER) for storing the active property for a lookup. If two threads race to perform a lookup, one could stomp the other right in the pigeonhole. If a given context can only have a single lookup "in flight" at a time, then we could move the pigeonhole to the context for even greater memory savings (after we fix bug 408416, if that bug's fix doesn't obviate this entire pattern).
Fixed by bug 487930. /be