The result of a call to NS_NewXMLProcessingInstruction() is leaking. By inspection, I'm guessing that the initial refCount is not being released after AddContentAsLeaf(node) is called.
Gimme an r= (and maybe even a nsbeta3+) and I'll check this in (unless someone else beats me to it).
Re-assign to jst and mark nsbeta3+.
Fix checked in.
Marking verified per last comments.