Safari 4.0.4 Crash

The following piece of javascript will crash Safari nicely when triggered using
one of the methods described below. With my limited knowledge I am unable to tell
if it's exploitable or not. I therefore turn it over to "the internet". (tested
on Safari 4.0.4, Win XP Pro SP3)

============================

<script>
var data = "A";
while(data.length<0x40000){
data += data;
}
data2 = new Array();
for (x=0; x<4000; x++){
data2[x] = data+data;
}
</script>

============================

The crash is not immediate, but there are actually two ways to trigger it and I
believe they are separate problems.

The following will cause Safari to crash with “Access violation reading
[00000000]”.

* Window->Activity

Whereas these will crash Safari with “Access violation writing to [BBADBEEF]”

* Develop->Start Debugging Javascript
* Develop->Show Error Console (Unreliable)
* Develop->Show Web Inspector (Unreliable)
* (Right Click)->Inspect Element

I can’t seem to affect any registers in an advantageous way but I do see several
pointers to \x41 blocks on the stack. At least you could put shellcode in these
and jump to them if you could control EIP. If anyone is able to do anything with
this, please let me know.