HTMLNameCollection and friends are always rooted at a Document.
Created attachment 215894 [details] Patch
Committed r158563: <http://trac.webkit.org/changeset/158563>
Although it isn't obviously related, storage/domstorage/localstorage/storagetracker/storage-tracker-2-create.html and fast/block/float/float-append-child-crash.html both started crashing with r158563.