NSS hides some errors codes that makes it impossible for applications to detect that the PKCS#11 token has been locked. Upstream bug with patch: https://bugzilla.mozilla.org/show_bug.cgi?id=506966
Thanks for filing the upstream bug, this should be sufficient.