There's this comment in XPCWrappedJSClass::CallMethod:
// We use js_AllocStack, js_Invoke, and js_FreeStack so that the gcthings
// we use as args will be rooted by the engine as we do conversions and
// prepare to do the function call. This adds a fair amount of complexity,
// but is a good optimization compared to calling JS_AddRoot for each item.
I don't think this is correct anymore. In jsgc.cpp it seems like js_TraceContext only traces those parts of the stack that are pointed-to by JSStackFrames. The right thing here, I think, would be a JSAutoTempValueRooter.
Incidentally, I think making that change would also fix bug 476643.
I think we should do this, but there's no GC hazard here. js_AllocStack adds an entry to cx->stackHeaders, which is scanned on trace.
By "on trace," I mean "on GC."
This happened over a series of patches a while back.