Thanks to Andi Eades, and Steffen Grarup for finding and fixing this.

Basically, we were storing a local jobject ref and using it on
 another thread without calling NewGlobalRef.

The fix is below:

cvs diff WindowControlImpl.cpp NativeEventThread.cpp (in directory D:\Projects\mozilla\java\webclient\src_moz\)
Index: WindowControlImpl.cpp
===================================================================
RCS file: /cvsroot/mozilla/java/webclient/src_moz/WindowControlImpl.cpp,v
retrieving revision 1.5
diff -r1.5 WindowControlImpl.cpp
131c131,134
<     initContext->nativeEventThread = nsnull;
---
>     if (nsnull != initContext->nativeEventThread) {
>         ::util_DeleteGlobalRef(env, initContext->nativeEventThread);
>         initContext->nativeEventThread = nsnull;
>     }
Index: NativeEventThread.cpp
===================================================================
RCS file: /cvsroot/mozilla/java/webclient/src_moz/NativeEventThread.cpp,v
retrieving revision 1.7
diff -r1.7 NativeEventThread.cpp
213c213,215
<         initContext->nativeEventThread = obj; // VERY IMPORTANT!!
---
>         initContext->nativeEventThread =
>             ::util_NewGlobalRef(env, obj); // VERY IMPORTANT!!
>

*****CVS exited normally with code 1*****

java/webclient/src_moz/NativeEventThread.cpp

@@ -210,7 +210,9 @@ JNIEXPORT void JNICALL Java_org_mozilla_webclient_wrapper_1native_NativeEventThr
     
     if (nsnull == initContext->nativeEventThread) {
         // store the java EventRegistrationImpl class in the initContext
-        initContext->nativeEventThread = obj; // VERY IMPORTANT!!
+        initContext->nativeEventThread = 
+            ::util_NewGlobalRef(env, obj); // VERY IMPORTANT!!
+        
         // This enables the listener to call back into java
     }
     

java/webclient/src_moz/WindowControlImpl.cpp

@@ -128,7 +128,10 @@ Java_org_mozilla_webclient_wrapper_1native_WindowControlImpl_nativeDestroyInitCo
     initContext->actionQueue = nsnull;
     initContext->embeddedThread = nsnull;
     initContext->env = nsnull;
-    initContext->nativeEventThread = nsnull;
+    if (nsnull != initContext->nativeEventThread) {
+        ::util_DeleteGlobalRef(env, initContext->nativeEventThread);
+        initContext->nativeEventThread = nsnull;
+    }
     initContext->stopThread = -1;
     initContext->initComplete = FALSE;
     initContext->initFailCode = 0;