the following produces the described behavior:

t = db.jstests_capped4;
t.drop();

db.createCollection( "jstests_capped4",

{size:1000,capped:true}

);
t.ensureIndex(

{ i: 1 }

);
for( i = 0; i < 20; ++i ) {
t.save(

{ i : i }

);
}
c = t.find().sort(

{ $natural: -1 }

).limit( 2 );
c.next();

If I add more code to the end of this script the crash still occurs, but only as the shell is exiting.

After some investigation:
<http://www.nabble.com/Forcing-Complete-GC-Just-Before-Destroying-a-Context-td22879892.html>
> A few key realizations:
> - JSNatives never run when Finalizers run (helps to know if you care about
> thread safety)
> - Finalization happens in any order
> - References between unreachable objects are irrelvant (closer to
> Java-style GC rather than Cedar or Modula-3)
> - SpiderMonkey GC is not incremental (it always collects everything it can)

Let me know if you want me to fix, Eliot.