Did you test this again before moving it to ON_QA ? the crash does happen?
*** This bug has been marked as a duplicate of bug 852564 ***