As soon as I access the file dialog (be it to attach a file on a form or simply
'CTRL-O), FF crashes

#0  0x0000555b545bf94e in mozalloc_abort(char const*)
(msg=msg@entry=0x7f733dcfe530 "[Child 2791] ###!!! ABORT: Aborting on channel
error.: file /home/abuild/rpmbuild/BUILD/mozilla/ipc/glue/MessageChannel.cpp,
line 2152")
    at /usr/src/debug/mozilla/memory/mozalloc/mozalloc_abort.cpp:33
#1  0x00007f734c008ccb in Abort (aMsg=0x7f733dcfe530 "[Child 2791] ###!!!
ABORT: Aborting on channel error.: file
/home/abuild/rpmbuild/BUILD/mozilla/ipc/glue/MessageChannel.cpp, line 2152") at
/usr/src/debug/mozilla/xpcom/base/nsDebugImpl.cpp:449
#2  0x00007f734c008ccb in NS_DebugBreak(uint32_t, char const*, char const*,
char const*, int32_t) (aSeverity=<optimized out>, 
    aSeverity@entry=3, aStr=aStr@entry=0x7f734f6245b8 "Aborting on channel
error.", aExpr=aExpr@entry=0x0, aFile=aFile@entry=0x7f734f623218
"/home/abuild/rpmbuild/BUILD/mozilla/ipc/glue/MessageChannel.cpp",
aLine=aLine@entry=2152)
    at /usr/src/debug/mozilla/xpcom/base/nsDebugImpl.cpp:436
#3  0x00007f734c474908 in
mozilla::ipc::MessageChannel::OnChannelErrorFromLink() (this=0x7f733dd138c8)
    at /usr/src/debug/mozilla/ipc/glue/MessageChannel.cpp:2152
#4  0x00007f734c474be0 in mozilla::ipc::ProcessLink::OnChannelError()
(this=0x7f733bbd5340)
    at /usr/src/debug/mozilla/ipc/glue/MessageLink.cpp:351
#5  0x00007f734c463252 in event_process_active_single_queue
(activeq=0x7f733dd4b950, base=0x7f733ddbe000)
    at
/usr/src/debug/mozilla/ipc/chromium/src/third_party/libevent/event.c:1350
#6  0x00007f734c463252 in event_process_active (base=<optimized out>)
    at
/usr/src/debug/mozilla/ipc/chromium/src/third_party/libevent/event.c:1420
#7  0x00007f734c463252 in event_base_loop (base=0x7f733ddbe000,
flags=flags@entry=1)
    at
/usr/src/debug/mozilla/ipc/chromium/src/third_party/libevent/event.c:1621
#8  0x00007f734c448bce in
base::MessagePumpLibevent::Run(base::MessagePump::Delegate*)
(this=0x7f733dd40b80, delegate=0x7f733dcfe960)
    at
/usr/src/debug/mozilla/ipc/chromium/src/base/message_pump_libevent.cc:380
#9  0x00007f734c44be20 in MessageLoop::RunInternal() (this=0x7f733dcfe960)
    at /usr/src/debug/mozilla/ipc/chromium/src/base/message_loop.cc:232
#10 0x00007f734c44be20 in MessageLoop::RunHandler() (this=0x7f733dcfe960)
    at /usr/src/debug/mozilla/ipc/chromium/src/base/message_loop.cc:225
#11 0x00007f734c44be20 in MessageLoop::Run() (this=this@entry=0x7f733dcfe960)
    at /usr/src/debug/mozilla/ipc/chromium/src/base/message_loop.cc:205
#12 0x00007f734c45816d in base::Thread::ThreadMain() (this=0x7f733dd4f2a8) at
/usr/src/debug/mozilla/ipc/chromium/src/base/thread.cc:180
#13 0x00007f734c4557da in ThreadFunc(void*) (closure=<optimized out>)
    at /usr/src/debug/mozilla/ipc/chromium/src/base/platform_thread_posix.cc:38
#14 0x00007f7350bed4e7 in start_thread () at /lib64/libpthread.so.0
#15 0x00007f734a9dea2f in clone () at /lib64/libc.so.6
(gdb)