Use-after-free vulnerability in the nsHTMLSelectElement function in nsHTMLSelectElement.cpp in Mozilla Firefox 4.x through 8.0, Thunderbird 5.0 through 8.0, and SeaMonkey before 2.6 allows remote attackers to execute arbitrary code via vectors involving removal of the parent node of an element.
https://bugzilla.mozilla.org/show_bug.cgi?id=739343
http://www.mozilla.org/security/announce/2012/mfsa2012-41.html