JavaScript garbage-collection hazards — Mozilla

Garbage collection hazards have been found in the JavaScript engine where some routines used temporary variables that were not properly protected (rooted). Specially crafted objects could contain a user-defined method that would be called during the lifetime of these temporaries. If this method triggered garbage collection the engine would operate on the unexpectedly freed temporary object when it returned from the user-defined routine.