The Frequency X blog has a writeup on a NULL pointer dereference bug I found a while ago in Firefox. I always find these types of bugs interesting because they require such unique approaches to getting code execution. If youre similarly inclined, you can read the post and follow the details of the exploit process yourself.