The slow-script dialog logic needs to be re-fixed. Bug 699974 contained a flawed fix that needed to be backed out for the reason stated in bug 720289 comment 3. To restate: it is possible (esp. with flash plugins) for reentrent code to permanently escape the slow-script dialog and has caused several reported hangs.
I'm not an expert in this area (clearly) but it seems that nsJSContext needs a stack, not a single field, for ctx->callbackTime so that an outer invocation is neither liberated nor hung by an inner invocation.
Will wait on chromehang(bug 712109) to determine severity of this