Mozilla double frame construction crashes

Mozilla Firefox before 3.0.12 and Thunderbird allow remote attackers to cause a denial of service memory corruption and application crash or execute arbitrary code via vectors involving double frame construction, related to 1 nsHTMLContentSink.cpp, 2 nsXMLContentSink.cpp, and 3 nsPresShell.cpp, a...