Bug903994 exploitability

@selenamarie r?

You already reviewed this with an r+, the only thing that's new is the migration bits.