Attempt at fixing crash. I believe this is happening during session...

chrome/browser/xp_frame.cc

 // Copyright (c) 2006-2008 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/xp_frame.h"
 
 #include <windows.h>
 
 #include "base/command_line.h"
 #include "base/gfx/native_theme.h"
@@ skipping 2444 matching lines @@
 void XPFrame::SetIsOffTheRecord(bool value) {
   is_off_the_record_ = value;
 }
 
 void XPFrame::DestroyBrowser() {
   // TODO(beng): (Cleanup) tidy this up, just fixing the build red for now.
   // Need to do this first, before the browser_ is deleted and we can't remove
   // the tabstrip from the model's observer list because the model was
   // destroyed with browser_.
   if (browser_) {
+    if (bookmark_bar_view_.get() && bookmark_bar_view_->GetParent()) {
+      // The bookmark bar should not be parented by the time we get here.
+      // If you hit this NOTREACHED file a bug with the trace.
+      NOTREACHED();
+      bookmark_bar_view_->GetParent()->RemoveChildView(bookmark_bar_view_.get());
+    }
+
+    // Explicitly delete the BookmarkBarView now. That way we don't have to
+    // worry about the BookmarkBarView potentially outliving the Browser &
+    // Profile.
+    bookmark_bar_view_.reset(NULL);
+
     browser_->tabstrip_model()->RemoveObserver(tabstrip_);
     delete browser_;
     browser_ = NULL;
   }
 }
 
 void XPFrame::ShelfVisibilityChangedImpl(TabContents* current_tab) {
   // Coalesce layouts.
   bool changed = false;
 
@@ skipping 15 matching lines @@
 
   // Only do a layout if the current contents is non-null. We assume that if the
   // contents is NULL, we're either being destroyed, or ShowTabContents is going
   // to be invoked with a non-null TabContents again so that there is no need
   // in doing a layout now (and would result in extra work/invalidation on
   // tab switches).
   if (changed && current_tab)
     Layout();
 }