crash on http://www.dhteumeuleu.com/run/fingers/

Program received signal SIGSEGV, Segmentation fault.
0xb660ca1d in KJS::UString::toStrictUInt32 (this=0x8207bd0, ok=0xbfe729bf) at /home/developer/trunk/JavaScriptCore/kjs/ustring.cpp:1140
1140      int len = m_rep->len;
(gdb) bt
#0  0xb660ca1d in KJS::UString::toStrictUInt32 (this=0x8207bd0, ok=0xbfe729bf) at /home/developer/trunk/JavaScriptCore/kjs/ustring.cpp:1140
#1  0xb70eae40 in KJS::UString::toArrayIndex (this=0x8207bd0, ok=0xbfe729bf) at /home/developer/trunk/JavaScriptCore/kjs/ustring.h:396
#2  0xb70eae82 in KJS::Identifier::toArrayIndex (this=0x8207bd0, ok=0xbfe729bf) at /home/developer/trunk/JavaScriptCore/kjs/identifier.h:65
#3  0xb65aedc6 in KJS::JSArray::getOwnPropertySlot (this=0xb3c97540, exec=0xbfe7397c, propertyName=@0x8207bd0, slot=@0xbfe72a18)
    at /home/developer/trunk/JavaScriptCore/kjs/JSArray.cpp:176
#4  0xb70ebfa9 in KJS::JSObject::getPropertySlot (this=0xb3c97540, exec=0xbfe7397c, propertyName=@0x8207bd0, slot=@0xbfe72a18)
    at /home/developer/trunk/JavaScriptCore/kjs/JSObject.h:494
#5  0xb65be945 in KJS::JSObject::hasProperty (this=0xb3c97540, exec=0xbfe7397c, propertyName=@0x8207bd0) at /home/developer/trunk/JavaScriptCore/kjs/JSObject.cpp:181
#6  0xb663b99f in KJS::JSPropertyNameIterator::next (this=0xb3c9c2c0, exec=0xbfe7397c) at /home/developer/trunk/JavaScriptCore/VM/JSPropertyNameIterator.cpp:117
#7  0xb6621e07 in KJS::Machine::privateExecute (this=0x80e6cb8, flag=KJS::Machine::Normal, exec=0xbfe7397c, registerFile=0x80e6cd0, r=0xb3cb50a0,
    scopeChain=0x81c4bd8, codeBlock=0x8207d70, exception=0xbfe73a04) at /home/developer/trunk/JavaScriptCore/VM/Machine.cpp:2451
#8  0xb662303d in KJS::Machine::execute (this=0x80e6cb8, programNode=0x81517f0, exec=0x815da08, scopeChain=0x8145340, thisObj=0xb3c90d40, exception=0xbfe73a04)
    at /home/developer/trunk/JavaScriptCore/VM/Machine.cpp:688
#9  0xb65e5eea in KJS::Interpreter::evaluate (exec=0x815da08, scopeChain=@0x8167204, sourceURL=@0xbfe73a94, startingLineNumber=1, source=@0xbfe73a8c,
    thisValue=0xb3c90d40) at /home/developer/trunk/JavaScriptCore/kjs/interpreter.cpp:83
#10 0xb770177c in WebCore::ScriptController::evaluate (this=0x810869c, filename=@0xbfe73b2c, baseLine=1, str=@0x81cf608)
    at /home/developer/trunk/WebCore/bindings/js/ScriptController.cpp:91
#11 0xb738a2a0 in WebCore::FrameLoader::executeScript (this=0x8108404, url=@0xbfe73b2c, baseLine=1, script=@0x81cf608)
    at /home/developer/trunk/WebCore/loader/FrameLoader.cpp:783
#12 0xb738a342 in WebCore::FrameLoader::executeScript (this=0x8108404, script=@0x81cf608, forceUserGesture=false)
    at /home/developer/trunk/WebCore/loader/FrameLoader.cpp:772
#13 0xb77007dc in WebCore::ScheduledAction::execute (this=0x81cf5f8, windowShell=0xb3c90d40) at /home/developer/trunk/WebCore/bindings/js/ScheduledAction.cpp:86
#14 0xb76d9c8a in WebCore::JSDOMWindowBase::timerFired (this=0xb3c90d60, timer=0x81cf830) at /home/developer/trunk/WebCore/bindings/js/JSDOMWindowBase.cpp:1246
#15 0xb76d9e4d in WebCore::DOMWindowTimer::fired (this=0x81cf830) at /home/developer/trunk/WebCore/bindings/js/JSDOMWindowBase.cpp:1299
#16 0xb68a6661 in WebCore::TimerBase::fireTimers (fireTime=1215014852.756712, firingTimers=@0xbfe73ccc)
    at /home/developer/trunk/BAL/OWBAL/Concretizations/Facilities/WK/BCTimerWK.cpp:347
#17 0xb68a66e7 in WebCore::TimerBase::sharedTimerFired () at /home/developer/trunk/BAL/OWBAL/Concretizations/Facilities/WK/BCTimerWK.cpp:368
#18 0xb68a130c in WebCore::fireTimerIfNeeded () at /home/developer/trunk/BAL/OWBAL/Concretizations/Facilities/Linux/BCSharedTimerLinux.cpp:84
#19 0x08049a98 in waitEvent () at /home/developer/trunk/WebKitTools/OWBLauncher/SDL/main.cpp:178
#20 0x08049d78 in main (argc=2, argv=0xbfe74004) at /home/developer/trunk/WebKitTools/OWBLauncher/SDL/main.cpp:224
(gdb) print m_rep
$1 = {m_ptr = 0x0}

with format.patch applied, I get the following crash:

Program received signal SIGSEGV, Segmentation fault.
0xb5be346a in ?? () from /usr/lib/libSDL-1.2.so.0
(gdb) bt
#0  0xb5be346a in ?? () from /usr/lib/libSDL-1.2.so.0
#1  0x00000000 in ?? ()
(gdb)