A long time ago (in bug 659738), I made the version of document.open() that calls window.open() use nsDocument::GetWindowInternal() instead of JS_GetGlobalForObject. Turns out this asserts. Not sure what the expected API is here.
Just GetWindow(), I think.
Created attachment 731850 [details] [diff] [review] Patch v1
Comment on attachment 731850 [details] [diff] [review] Patch v1 r=me, but watch out for bustage from the MOZ_ASSERT bits...