We traced the crash back to code that is trying to set the style display:none on an invisible YUI panel. The panel had position:absolute set with left:0 but no value for top. The new Safari did not like this.
Fixes also came in from Apple developers, who saw our blog entry on this yesterday and seem to have pulled an all nighter. They checked in a fix to WebKit last night, then sent us a CSS workaround. It was more elegant than our own workaround, though it arrived after our code went to QA so won't make it to production until the next non-emergency build.
Thanks to everybody who stepped on the gas to get this done.