Mozilla Firefox before 3.0.12 and Thunderbird allow remote attackers to cause a denial of service (memory corruption and application crash) or execute arbitrary code via vectors involving double frame construction related to (1) nsHTMLContentSink.cpp (2) nsXMLContentSink.cpp and (3) nsPresShell.cpp and the nsSubDocumentFrame::Reflow function.