Version:           3.5 (using KDE 3.5.0, compiled sources)
Compiler:          gcc version 3.4.3
OS:                Linux (i686) release 2.6.7

I'm using konqueror from 3.5 and kdelibs/khtml updated on Dec. 16.
Whenever I run konqueror and go to www.schloss-esterhazy.at it crashes with the following bt:
#5  0x41846d6a in __assert_fail () from /lib/libc.so.6
#6  0x41fba6fb in khtml::HTMLTokenizer::reset (this=0x9f) at htmltokenizer.cpp:159
#7  0x41fbac78 in ~HTMLTokenizer (this=0x856e978) at htmltokenizer.cpp:1681
#8  0x41f8ce08 in DOM::DocumentImpl::detach (this=0x856bbd8) at dom_docimpl.cpp:1187
#9  0x41f46b22 in KHTMLPart::clear (this=0x8362758) at khtml_part.cpp:1407
#10 0x41f46daa in KHTMLPart::begin (this=0x8362758, url=@0x83fc600, xOffset=0, yOffset=0) at khtml_part.cpp:1878
#11 0x41f37db6 in KHTMLPart::slotData (this=0x8362758, kio_job=0x8489ee0, data=@0xbfffbd00) at khtml_part.cpp:1579
#12 0x41f5a21c in KHTMLPart::qt_invoke (this=0x8362758, _id=16, _o=0xbfffb8d0) at private/qucom_p.h:312
#13 0x40f5ec37 in QObject::activate_signal (this=0x8489ee0, clist=0x856b050, o=0xbfffb8d0) at kernel/qobject.cpp:2355
#14 0x403aba19 in KIO::TransferJob::data (this=0xbfffb90c, t0=0x0, t1=@0x0) at jobclasses.moc:993
#15 0x403aba98 in KIO::TransferJob::slotData (this=0x8489ee0, _data=@0x0) at job.cpp:902
#16 0x403adc3d in KIO::TransferJob::qt_invoke (this=0x8489ee0, _id=18, _o=0xbfffb9f0) at private/qucom_p.h:312
#17 0x40f5ec37 in QObject::activate_signal (this=0x859d998, clist=0x856c280, o=0xbfffb9f0) at kernel/qobject.cpp:2355
#18 0x403937ed in KIO::SlaveInterface::data (this=0xbfffba18, t0=@0x0) at slaveinterface.moc:194
#19 0x4039796a in KIO::SlaveInterface::dispatch (this=0x859d998, _cmd=100, rawdata=@0xbfffbd00) at slaveinterface.cpp:234
#20 0x40395d3e in KIO::SlaveInterface::dispatch (this=0x859d998) at slaveinterface.cpp:173
#21 0x4038f81e in KIO::Slave::gotInput (this=0x859d998) at slave.cpp:300
#22 0x403907e8 in KIO::Slave::qt_invoke (this=0x859d998, _id=4, _o=0xbfffbe80) at slave.moc:113
#23 0x40f5ec37 in QObject::activate_signal (this=0x859d798, clist=0x856c388, o=0xbfffbe80) at kernel/qobject.cpp:2355
#24 0x40f5ef71 in QObject::activate_signal (this=0x859d798, signal=2, param=21) at kernel/qobject.cpp:2448
#25 0x412cc221 in QSocketNotifier::activated (this=0x859d798, t0=21) at .moc/debug-shared-mt/moc_qsocketnotifier.cpp:85
#26 0x40f7faff in QSocketNotifier::event (this=0x859d798, e=0xbfffc1c0) at kernel/qsocketnotifier.cpp:258
#27 0x40efa0d5 in QApplication::internalNotify (this=0xbfffed00, receiver=0x859d798, e=0xbfffc1c0)
    at kernel/qapplication.cpp:2635
#28 0x40ef9616 in QApplication::notify (this=0xbfffed00, receiver=0x859d798, e=0xbfffc1c0) at kernel/qapplication.cpp:2358

I tried to run it in valgrind, but there it did not crash and I only got:
==8735== Conditional jump or move depends on uninitialised value(s)
==8735==    at 0x1E1276A6: KHTMLPart::clear() (khtml_part.cpp:1370)
==8735==    by 0x1E127DA9: KHTMLPart::begin(KURL const&, int, int) (khtml_part.cpp:1878)
==8735==    by 0x1E118DB5: KHTMLPart::slotData(KIO::Job*, QMemArray<char> const&) (khtml_part.cpp:1579)
==8735==    by 0x1E13B21B: KHTMLPart::qt_invoke(int, QUObject*) (private/qucom_p.h:312)