The following piece of javascript will crash Safari nicely when triggered using one of the methods described below.  With my limited knowledge I am unable to tell if it's exploitable or not.  I therefore turn it over to "the internet".  (tested on Safari 4.0.4, Win XP Pro SP3)

============================

<script>
var data = "A";
while(data.length<0x40000){
data += data;
}
data2 = new Array();
for (x=0; x<4000; x++){
data2[x] = data+data;
}
</script>

============================

The crash is not immediate, but there are actually two ways to trigger it and I believe they are separate problems.

The following will cause Safari to crash with “Access violation reading [00000000]”.

    * Window->Activity

Whereas these will crash Safari with “Access violation writing to [BBADBEEF]”

    * Develop->Start Debugging Javascript
    * Develop->Show Error Console (Unreliable)
    * Develop->Show Web Inspector (Unreliable)
    * (Right Click)->Inspect Element

I can’t seem to affect any registers in an advantageous way but I do see several pointers to \x41 blocks on the stack.  At least you could put shellcode in these and jump to them if you could control EIP.  If anyone is able to do anything with this, please let me know.