--- a/dom/browser-element/BrowserElementParent.js
+++ b/dom/browser-element/BrowserElementParent.js
@@ -10,17 +10,16 @@ var Cc = Components.classes;
 var Cr = Components.results;
 
 /* BrowserElementParent injects script to listen for certain events in the
  * child.  We then listen to messages from the child script and take
  * appropriate action here in the parent.
  */
 
 Cu.import("resource://gre/modules/Services.jsm");
-Cu.import("resource://gre/modules/NetUtil.jsm");
 Cu.import("resource://gre/modules/XPCOMUtils.jsm");
 Cu.import("resource://gre/modules/BrowserElementPromptService.jsm");
 
 XPCOMUtils.defineLazyGetter(this, "DOMApplicationRegistry", function () {
   Cu.import("resource://gre/modules/Webapps.jsm");
   return DOMApplicationRegistry;
 });
 
@@ -997,27 +996,46 @@ BrowserElementParent.prototype = {
                                 aOffset, aCount) {
         this.extListener.onDataAvailable(aRequest, aContext, aInputStream,
                                          aOffset, aCount);
       },
       QueryInterface: XPCOMUtils.generateQI([Ci.nsIStreamListener,
                                              Ci.nsIRequestObserver])
     };
 
-    let referrer = Services.io.newURI(_options.referrer, null, null);
-    let principal =
-      Services.scriptSecurityManager.createCodebasePrincipal(
-        referrer, this._frameLoader.loadContext.originAttributes);
+    // If we have a URI we'll use it to get the triggering principal to use,
+    // if not available a null principal is acceptable.
+    let referrer = null;
+    let principal = null;
+    if (_options.referrer) {
+      // newURI can throw on malformed URIs.
+      try {
+        referrer = Services.io.newURI(_options.referrer, null, null);
+      }
+      catch(e) {
+        debug('Malformed referrer -- ' + e);
+      }
 
-    let channel = NetUtil.newChannel({
-      uri: url,
-      loadingPrincipal: principal,
-      securityFlags: SEC_ALLOW_CROSS_ORIGIN_DATA_INHERITS,
-      contentPolicyType: Ci.nsIContentPolicy.TYPE_OTHER
-    });
+      // This simply returns null if there is no principal available
+      // for the requested uri. This is an acceptable fallback when
+      // calling newChannelFromURI2.
+      principal =
+        Services.scriptSecurityManager.createCodebasePrincipal(
+          referrer, this._frameLoader.loadContext.originAttributes);
+    }
+
+    debug('Using principal? ' + !!principal);
+
+    let channel =
+      Services.io.newChannelFromURI2(url,
+                                     null,       // No document.
+                                     principal,  // Loading principal
+                                     principal,  // Triggering principal
+                                     Ci.nsILoadInfo.SEC_NORMAL,
+                                     Ci.nsIContentPolicy.TYPE_OTHER);
 
     // XXX We would set private browsing information prior to calling this.
     channel.notificationCallbacks = interfaceRequestor;
 
     // Since we're downloading our own local copy we'll want to bypass the
     // cache and local cache if the channel let's us specify this.
     let flags = Ci.nsIChannel.LOAD_CALL_CONTENT_SNIFFERS |
                 Ci.nsIChannel.LOAD_BYPASS_CACHE;
@@ -1032,17 +1050,17 @@ BrowserElementParent.prototype = {
       debug('Setting HTTP referrer = ' + (referrer && referrer.spec));
       channel.referrer = referrer;
       if (channel instanceof Ci.nsIHttpChannelInternal) {
         channel.forceAllowThirdPartyCookie = true;
       }
     }
 
     // Set-up complete, let's get things started.
-    channel.asyncOpen2(new DownloadListener());
+    channel.asyncOpen(new DownloadListener(), null);
 
     return req;
   },
 
   getScreenshot: function(_width, _height, _mimeType) {
     if (!this._isAlive()) {
       throw Components.Exception("Dead content process",
                                  Cr.NS_ERROR_DOM_INVALID_STATE_ERR);