Bug 1034640 - crash in nsAccessibilityService::CreateAccessibleByFrameType, r=tbsaunde