This bug was filed from the Socorro interface and is
report bp-190bf26c-8679-45ab-b3c9-0405c2111114 .
This happens on both 10.0a2 Aurora and 11.0a1 Nightly, just that the signature changed from js::RegExpPrivate::decref to js::detail::RegExpPrivate::decref
It looks like this started right around the uplift day, the first crashes are from 2011-11-09 on both channels.
Should track volume and see what happens.
With combined signatures, it's #4 top crasher in 10.0a2 and 11.0a1.
No crashes any more with builds from 2011-11-15 or later, it seems. Fixed by bug 701761 perhaps?