This test Web page still reliably reproduces bug #289476 for me -- try repeatedly clicking "Expand", then "Collapse", to activate the Java applet below. The original problem showed up in this more functional Web page -- try repeatedly expanding, then collapsing, the applet for any of the Life patterns.
Previous reports referenced this simpler test page, but since Firefox 1.02 this no longer reliably reproduces the bug.
In the original Javascript code, I used document.all() instead of document.getElementById()... but it doesn't appear to make any difference; Firefox 1.5 Beta 1 crashes with either syntax.
For comparison, try out this page, which does NOT crash Firefox -- the only functional difference is the addition of a space after the <BR> tag in the associated Javascript.