I guess the browsers weren't sandboxed? Apparently this doesn't affect chrome, but as I understand it its not the sandboxing function that saves from the crash but the fact that Chrome doesn't allow loading of images with malformed path.