The reported crash is triggered by the an escape function at the site http://www.aport.ru/. The combination of tracing optimization and the failure in the processes of "deep bail" clean up is fixed in update3.5.1. After the update users should reset the value of javascript.options.jit.content to true.