--- a/content/xul/document/src/nsXULDocument.cpp
+++ b/content/xul/document/src/nsXULDocument.cpp
@@ -2771,17 +2771,29 @@ nsXULDocument::LoadOverlayInternal(nsIUR
         if (! parserObserver)
             return NS_ERROR_OUT_OF_MEMORY;
 
         NS_ADDREF(parserObserver);
         parser->Parse(aURI, parserObserver);
         NS_RELEASE(parserObserver);
 
         nsCOMPtr<nsILoadGroup> group = do_QueryReferent(mDocumentLoadGroup);
-        rv = NS_OpenURI(listener, nsnull, aURI, nsnull, group);
+        nsCOMPtr<nsIChannel> channel;
+        rv = NS_NewChannel(getter_AddRefs(channel), aURI, nsnull, group);
+
+        if (NS_SUCCEEDED(rv)) {
+            // Set the owner of the channel to be our principal so
+            // that the overlay's JSObjects etc end up being created
+            // with the right principal and in the correct
+            // compartment.
+            channel->SetOwner(NodePrincipal());
+
+            rv = channel->AsyncOpen(listener, nsnull);
+        }
+
         if (NS_FAILED(rv)) {
             // Abandon this prototype
             mCurrentPrototype = nsnull;
 
             // The parser won't get an OnStartRequest and
             // OnStopRequest, so it needs a Terminate.
             parser->Terminate();
 
@@ -4526,17 +4538,17 @@ nsXULDocument::ParserObserver::OnStartRe
     if (mPrototype) {
         nsCOMPtr<nsIChannel> channel = do_QueryInterface(request);
         nsIScriptSecurityManager* secMan = nsContentUtils::GetSecurityManager();
         if (channel && secMan) {
             nsCOMPtr<nsIPrincipal> principal;
             secMan->GetChannelPrincipal(channel, getter_AddRefs(principal));
 
             // Failure there is ok -- it'll just set a (safe) null principal
-            mPrototype->SetDocumentPrincipal(principal);            
+            mPrototype->SetDocumentPrincipal(principal);
         }
 
         // Make sure to avoid cycles
         mPrototype = nsnull;
     }
         
     return NS_OK;
 }