Bug 900835 - crash in nsEventStateManager::PreHandleEvent (Accessible::DoCommand, r=smaug, tbsaunde