From what I can understand in the referenced bug, somewhere we need to call
browser.presetOpenerWindow(aOpener); in the openuri function.

I tried to put the following patch:
modified   modules/content-buffer.js
@@ -615,6 +615,9 @@ browser_dom_window.prototype = {
 
         /* Determine the opener buffer */
         var opener = get_buffer_from_frame(this.window, aOpener);
+        if (aOpener) {
+            this.browser.presetOpenerWindow(aOpener);
+        }
 
         switch (browser_default_open_target) {
         case OPEN_CURRENT_BUFFER:

And that fixes the crash - though I have issues to open links from gmail for
example, a dialog box is shown telling that there is probably a popup blocker
preventing to open the page and the page is not displayed;


I am not sure if I can help more with my current knowledge, as I don't really
understand what I am doing here. :) Scott, maybe you understand better than me
and you have some time to look into it ? Else I might ask some help on the
mozilla irc.