firefox -- javascript garbage collector vulnerability

Mozilla Foundation reports:

Fixes for security problems in the JavaScript engine described in
MFSA 2008-15 introduced a stability problem, where some users
experienced crashes during JavaScript garbage collection. This is
being fixed primarily to address stability concerns. We have no
demonstration that this particular crash is exploitable but are
issuing this advisory because some crashes of this type have been
shown to be exploitable in the past.