jQuery1.4.2 $.ajax crashes IE6/7

Question

Hello there!

I'm having a really hard time debugging one of our latest reported bugs. The problem occurs "randomly", not on every page load, sometimes I can "click" around for a minute or two before IE6/7 crashes. By crash I mean that the IE-window shuts down and I get the option to send the crash info to Microsoft.

In FF, Chrome, Safari, IE8 everything is working perfectly.

What the page does is issuing 2 AJAX Jsonp calls and building some menus with the data returned. The data brought back can be from ~500b to approx. 35kb.

The JSON is valid (else it wouldn't have loaded at all in FF etc), and as i told previous, it works for when navigating around the site soemtimes in IE6/7.

I've tested to comment out the callbacks, still crashes. If I remove the $.ajax calls the page will work again. Whats strange is that if I downgrade to jQuery 1.3.2 everything works in all browsers including IE6/7.

I've taken the crash-logs and looked at them in WinDbg and what happens seems to be a NULL POINTER reference.

The last entries of the stack trace is as follows

mshtml!CTreePos::SourceIndex+0x9
mshtml!CMarkup::InsertElementInternal+0x3a8
mshtml!CDoc::InsertElement+0x98
mshtml!CDocument::get_implementation+0x144

Anyone having a clue what could cause this?

EDIT #2:

I've tested even more and it seems the problem is related to the jsonpCallback parameter.

If I dont specify any callback it seems to work, if I specify it will start to crash again.

Anyone seen this behaviour before? I'm using the callback-parameter to get better browser caching.

EDIT:

People wanted to see some code

$.ajax({
    url: url,
    dataType: 'jsonp',
    data: requestData,
    jsonpCallback: 'filterdata',
    contentType: 'application/json', /*** Tested without ContentType set also  ***/
    success: function(data) { 
        /*** Ive tested without callbacks, crashes also! ***/
        fillExpandableFilterList(toolbarContainer.find('#QuickFilterSubmenu > ul.List'), data.QuickFilters, {
            name: 'QuestionName',
            children: 'AnswerOptions',
            childId: 'Id',
            childName: 'Text'
        });
        fillFilterList(toolbarContainer.find('#TimeFilterSubmenu > ul.List'), data.Timefilters, {
            'id': 'Id',
            'name': 'Text'
        });
        fillFilterList(toolbarContainer.find('#SourceFilterSubmenu > ul.List'), data.SourceFilters, {
            'id': 'Id',
            'name': 'Text'
        });
        fillHierarchyFilterList(toolbarContainer.find('#HierarchyFilterSubmenu > ul.List'), data.Hierarchies, {
            id: 'Id',
            name: 'Name',
            children: 'Children'
        });
        setupFilterMenus(toolbarContainer.find('.FilterMenuButtons > li'));
    }
});