(This bug doesn't exist on trunk until I land bug 322889, but I need a bug number assigned for a FIXME.)
array_lookupProperty uses a per-object pigeonhole (JSSLOT_ARRAY_LOOKUP_HOLDER) for storing the active property for a lookup. If two threads race to perform a lookup, one could stomp the other right in the pigeonhole.
If a given context can only have a single lookup "in flight" at a time, then we could move the pigeonhole to the context for even greater memory savings (after we fix bug 408416, if that bug's fix doesn't obviate this entire pattern).
*** Bug 419537 has been marked as a duplicate of this bug. ***
Fixed by bug 487930.