Steps to reproduce:
 
 

Tries to execute custom code. As soon as Firefox crashes, look in your C: drive, you'll find a file named "proof.of.exploit" there if it works as expected.

If you cannot reproduce: close firefox, start firefox again, load testcase

If it still doesn't work: save testcase to disk, right click, run in firefox

This requires Firefox 1.8.0.4: 2006050817 (probably it works with the German version only)