plugin2 crash in mshtml.dll / sun.plugin2.main.server.IExplorerPlugin.javaScriptReleaseObject

Customer application crash with plugin2 enabled on IE. The generated hs_err log file gives the following stack trace :

Stack: [0x07660000,0x07760000], sp=0x0775fa38, free space=1022k
Native frames: (J=compiled Java code, j=interpreted, Vv=VM code, C=native code)
C [mshtml.dll+0x965ff]
C [mshtml.dll+0x68c6a]
C [mshtml.dll+0x69611]
C [jp2iexp.dll+0x2fad]
j sun.plugin2.main.server.IExplorerPlugin.javaScriptReleaseObject(Lsun/plugin2/liveconnect/BrowserSideObject;)V+4
j sun.plugin2.main.server.LiveConnectSupport$PerPluginInfo.releaseAllObjects()V+34
j sun.plugin2.main.server.LiveConnectSupport.shutdown(I)V+42
j sun.plugin2.main.server.JVMInstance.unregisterApplet(I)V+63
j sun.plugin2.main.server.JVMInstance.dispose()V+67
j sun.plugin2.main.server.JVMInstance.access$2600(Lsun/plugin2/main/server/JVMInstance;)V+1
j sun.plugin2.main.server.JVMInstance$Listener.jvmExited(Lsun/plugin2/jvm/JVMLauncher;)V+86
j sun.plugin2.jvm.JVMLauncher.fireJVMExited()V+31
j sun.plugin2.jvm.JVMLauncher.access$300(Lsun/plugin2/jvm/JVMLauncher;)V+1
j sun.plugin2.jvm.JVMLauncher$JVMWatcher.run()V+50
j java.lang.Thread.run()V+11
v ~StubRoutines::call_stub

Java frames: (J=compiled Java code, j=interpreted, Vv=VM code)
j sun.plugin2.main.server.IExplorerPlugin.iUnknownRelease(J)V+0
j sun.plugin2.main.server.IExplorerPlugin.javaScriptReleaseObject(Lsun/plugin2/liveconnect/BrowserSideObject;)V+4
j sun.plugin2.main.server.LiveConnectSupport$PerPluginInfo.releaseAllObjects()V+34
j sun.plugin2.main.server.LiveConnectSupport.shutdown(I)V+42
j sun.plugin2.main.server.JVMInstance.unregisterApplet(I)V+63
j sun.plugin2.main.server.JVMInstance.dispose()V+67
j sun.plugin2.main.server.JVMInstance.access$2600(Lsun/plugin2/main/server/JVMInstance;)V+1
j sun.plugin2.main.server.JVMInstance$Listener.jvmExited(Lsun/plugin2/jvm/JVMLauncher;)V+86
j sun.plugin2.jvm.JVMLauncher.fireJVMExited()V+31
j sun.plugin2.jvm.JVMLauncher.access$300(Lsun/plugin2/jvm/JVMLauncher;)V+1
j sun.plugin2.jvm.JVMLauncher$JVMWatcher.run()V+50
j java.lang.Thread.run()V+11
v ~StubRoutines::call_stub


This can be reproduce on demand (see the Comments section to reproduce).
complete hs_err log file, plugin.trace and plugin.log in attachment.