This bug was filed from the Socorro interface and is
report bp-fecef6e1-ff04-42ce-a934-3db5d2111017 .
Alexander, this awfully looks like a regression from the recent work you did in that particular code area, right?
it is, looks like a dupe of bug 694824
OK, I just reproduced this crash just by opening a bug URL from within Chatzilla. I have ChatZilla running as a XULRunner application, and I opened actually this very bug from within a chat window. So opening any link from within Thunderbird with NVDA running should reproduce this bug.
Created attachment 567434 [details] [diff] [review]
in this case document root frame is not constructed yet, in general frame might be not available for unattached subtree but not yet destroyed
*** Bug 694824 has been marked as a duplicate of this bug. ***
Comment on attachment 567434 [details] [diff] [review]
Verified fixed in Mozilla/5.0 (Windows NT 6.1; WOW64; rv:10.0a1) Gecko/20111019 Firefox/10.0a1