Config. : jre 7 deploy nightly build on 3/3/2011
          FF 3.6.9 or 4 beta
          windows XP SP3

To reproduce:
- open FF with a page without an applet (e.g. oracle.com)
- navigate to the following page with 2 applets:
    http://davidmlane.com/hyperstat/z_table.html
- click the browser back button

(if no crash, click the browser forward button and then back button, repeat)
Note: you don't need to click forward and back buttons quickly to reproduce the crash.


Initial call stack:

> msvcr100.dll!_crt_debugger_hook(int _Reserved) Line 65 C
     msvcr100.dll!_call_reportfault(int nDbgHookCode, unsigned long dwExceptionCode, unsigned long dwExceptionFlags) Line 255 + 0x6 bytes C++
     msvcr100.dll!_invoke_watson(const wchar_t * pszExpression, const wchar_t * pszFunction, const wchar_t * pszFile, unsigned int nLine, unsigned int pReserved) Line 155 + 0xf bytes C++
     msvcr100.dll!_invalid_parameter(const wchar_t * pszExpression, const wchar_t * pszFunction, const wchar_t * pszFile, unsigned int nLine, unsigned int pReserved) Line 110 + 0x14 bytes C++
     msvcr100.dll!_invalid_parameter_noinfo() Line 121 + 0xc bytes C++
     msvcr100.dll!_close(int fh) Line 46 + 0x24 bytes C
     jvm.dll!6da83ab8()
     [Frames below may be incorrect and/or missing, no symbols loaded for jvm.dll]
     user32.dll!__EndUserApiHook@0() + 0x11 bytes
     jvm.dll!6da80dd0()

==========

Top frame points to dbghook.c

__declspec(noinline)
void __cdecl _CRT_DEBUGGER_HOOK(int _Reserved)
{
    /* assign 0 to _debugger_hook_dummy so that the function is not folded in retail */
    (_Reserved);
    _debugger_hook_dummy = 0; <==== top frame points to here
}

Attached files are:
    hs err log
    test.html (html page source from the original site)
    jar files for the 2 applets