Tor Browser 5.0a3 crashes with security level set to "High"

If I load nytimes.com on 32bit Linux machines and on Windows it crashes right away if I have security slider set to "High". On a test machine I get the following stack trace:

Program received signal SIGSEGV, Segmentation fault.
0xb3d62e2a in nsAttrValue::Type() const ()
    at /home/ubuntu/build/tor-browser/dom/base/nsAttrValue.h:455
455	/home/ubuntu/build/tor-browser/dom/base/nsAttrValue.h: Datei oder Verzeichnis nicht gefunden.
(gdb) bt
#0  0xb3d62e2a in nsAttrValue::Type() const ()
    at /home/ubuntu/build/tor-browser/dom/base/nsAttrValue.h:455
#1  0xb3d62f45 in nsAttrValue::GetAtomCount() const ()
    at /home/ubuntu/build/tor-browser/dom/base/nsAttrValue.cpp:807
#2  0xb476c61e in RuleHash::EnumerateAllRules(mozilla::dom::Element*, ElementDependentRuleProcessorData*, NodeMatchContext&) ()
    at /home/ubuntu/build/tor-browser/layout/style/nsCSSRuleProcessor.cpp:677
#3  0xb476ddb9 in nsCSSRuleProcessor::RulesMatching(ElementRuleProcessorData*)
    ()
    at /home/ubuntu/build/tor-browser/layout/style/nsCSSRuleProcessor.cpp:2551
#4  0xb47bff07 in bool EnumRulesMatching<ElementRuleProcessorData>(nsIStyleRuleProcessor*, void*) ()
    at /home/ubuntu/build/tor-browser/layout/style/nsStyleSet.cpp:719
#5  0xb47cbbb5 in nsStyleSet::FileRules(bool (*)(nsIStyleRuleProcessor*, void*), RuleProcessorData*, mozilla::dom::Element*, nsRuleWalker*) ()
    at /home/ubuntu/build/tor-browser/layout/style/nsStyleSet.cpp:1026
#6  0xb47d0947 in nsStyleSet::ResolveStyleFor(mozilla::dom::Element*, nsStyleContext*, TreeMatchContext&) ()
    at /home/ubuntu/build/tor-browser/layout/style/nsStyleSet.cpp:1265
#7  0xb481c70e in nsCSSFrameConstructor::ResolveStyleContext(nsStyleContext*, nsIContent*, nsFrameConstructorState*) ()
    at /home/ubuntu/build/tor-browser/layout/base/nsCSSFrameConstructor.cpp:4831
#8  0x9b98d7f0 in ?? ()
#9  0x9a308aa0 in ?? ()
Backtrace stopped: previous frame inner to this frame (corrupt stack?)