Created attachment 546103 [details]
testcase (crashes Firefox when loaded)
Created attachment 546104 [details]
stack trace (repeating portion only)
Hey, this is why we should self-host forEach! ;)
Might need a recursion check in bound functions, or might need it for array extras. Will investigate soon.
See also bug 684462, with Array.sort.
Jesse, bug 779215 likely fixed a lot of these bugs. Perhaps you'd like to retest?