I'm turning this into a warning for now, since many crashtests hit it. This bug tracks turning it back into an assertion. ###!!! ASSERTION: Adding child where we already have a child? This will likely misbehave: 'Error', file /Users/jruderman/central/docshell/shistory/src/nsSHEntry.cpp, line 598
Bug 632835 converted it back into an assertion. (replacing NS_WARN_IF_FALSE with a NS_ERROR): http://hg.mozilla.org/mozilla-central/rev/ee2e22296d3c Resolving as FIXED by that bug.