Fix for 95422. r/sr=the usuals (brendan et al)

content/xbl/src/nsXBLPrototypeBinding.cpp

@@ -643,6 +643,7 @@ nsXBLPrototypeBinding::AttributeChanged(nsIAtom* aAttribute, PRInt32 aNameSpaceI
     nsCOMPtr<nsIContent> realElement;
     LocateInstance(aChangedElement, content, aAnonymousContent, element, getter_AddRefs(realElement));
 
+    if (realElement) {
       xblAttr->GetDstAttribute(getter_AddRefs(dstAttr));
 
       if (aRemoveFlag)
@@ -699,6 +700,7 @@ nsXBLPrototypeBinding::AttributeChanged(nsIAtom* aAttribute, PRInt32 aNameSpaceI
           }
         }
       }
+    }
 
     nsCOMPtr<nsIXBLAttributeEntry> tmpAttr = xblAttr;
     tmpAttr->GetNext(getter_AddRefs(xblAttr));