--- a/toolkit/components/places/src/nsNavHistoryResult.cpp
+++ b/toolkit/components/places/src/nsNavHistoryResult.cpp
@@ -2090,17 +2090,17 @@ nsNavHistoryQueryResultNode::CanExpand()
 // nsNavHistoryQueryResultNode::IsContainersQuery
 //
 // Some query with a particular result type can contain other queries,
 // they must be always expandable
 
 PRBool
 nsNavHistoryQueryResultNode::IsContainersQuery()
 {
-  PRUint16 resultType = mOptions->ResultType();
+  PRUint16 resultType = Options()->ResultType();
   return resultType == nsINavHistoryQueryOptions::RESULTS_AS_DATE_QUERY ||
          resultType == nsINavHistoryQueryOptions::RESULTS_AS_DATE_SITE_QUERY ||
          resultType == nsINavHistoryQueryOptions::RESULTS_AS_TAG_QUERY ||
          resultType == nsINavHistoryQueryOptions::RESULTS_AS_SITE_QUERY;
 }
 
 // nsNavHistoryQueryResultNode::OnRemoving
 //
@@ -2258,25 +2258,34 @@ nsNavHistoryQueryResultNode::GetQueries(
 
 
 // nsNavHistoryQueryResultNode::GetQueryOptions
 
 NS_IMETHODIMP
 nsNavHistoryQueryResultNode::GetQueryOptions(
                                       nsINavHistoryQueryOptions** aQueryOptions)
 {
-  nsresult rv = VerifyQueriesParsed();
-  NS_ENSURE_SUCCESS(rv, rv);
-  NS_ASSERTION(mOptions, "Options invalid");
-
-  *aQueryOptions = mOptions;
+  *aQueryOptions = Options();
   NS_ADDREF(*aQueryOptions);
   return NS_OK;
 }
 
+// nsNavHistoryQueryResultNode::Options
+//
+//  Safe options getter, ensures queries are parsed first.
+
+nsNavHistoryQueryOptions*
+nsNavHistoryQueryResultNode::Options()
+{
+  nsresult rv = VerifyQueriesParsed();
+  if (NS_FAILED(rv))
+    return nsnull;
+  NS_ASSERTION(mOptions, "Options invalid, cannot generate from URI");
+  return mOptions;
+}
 
 // nsNavHistoryQueryResultNode::VerifyQueriesParsed
 
 nsresult
 nsNavHistoryQueryResultNode::VerifyQueriesParsed()
 {
   if (mQueries.Count() > 0) {
     NS_ASSERTION(mOptions, "If a result has queries, it also needs options");

--- a/toolkit/components/places/src/nsNavHistoryResult.h
+++ b/toolkit/components/places/src/nsNavHistoryResult.h
@@ -720,16 +720,19 @@ public:
 
   // these may be constructed lazily from mURI, call VerifyQueriesParsed
   // either this or mURI should be valid
   nsCOMArray<nsNavHistoryQuery> mQueries;
   PRUint32 mLiveUpdate; // one of QUERYUPDATE_* in nsNavHistory.h
   PRBool mHasSearchTerms;
   nsresult VerifyQueriesParsed();
 
+  // safe options getter, ensures queries are parsed
+  nsNavHistoryQueryOptions* Options();
+
   // this indicates whether the query contents are valid, they don't go away
   // after the container is closed until a notification comes in
   PRBool mContentsValid;
 
   PRBool mBatchInProgress;
 
   nsresult FillChildren();
   void ClearChildren(PRBool unregister);

new file mode 100644
--- /dev/null
+++ b/toolkit/components/places/tests/unit/test_433525_hasChildren_crash.js
@@ -0,0 +1,83 @@
+/* -*- Mode: Java; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim:set ts=2 sw=2 sts=2 et: */
+/* ***** BEGIN LICENSE BLOCK *****
+ * Version: MPL 1.1/GPL 2.0/LGPL 2.1
+ *
+ * The contents of this file are subject to the Mozilla Public License Version
+ * 1.1 (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ * http://www.mozilla.org/MPL/
+ *
+ * Software distributed under the License is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+ * for the specific language governing rights and limitations under the
+ * License.
+ *
+ * The Original Code is Bug 433525 code.
+ *
+ * The Initial Developer of the Original Code is Mozilla Corp.
+ * Portions created by the Initial Developer are Copyright (C) 2008
+ * the Initial Developer. All Rights Reserved.
+ *
+ * Contributor(s):
+ *  Dietrich Ayala <dietrich@mozilla.com> (Original Author)
+ *
+ * Alternatively, the contents of this file may be used under the terms of
+ * either the GNU General Public License Version 2 or later (the "GPL"), or
+ * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
+ * in which case the provisions of the GPL or the LGPL are applicable instead
+ * of those above. If you wish to allow use of your version of this file only
+ * under the terms of either the GPL or the LGPL, and not to allow others to
+ * use your version of this file under the terms of the MPL, indicate your
+ * decision by deleting the provisions above and replace them with the notice
+ * and other provisions required by the GPL or the LGPL. If you do not delete
+ * the provisions above, a recipient may use your version of this file under
+ * the terms of any one of the MPL, the GPL or the LGPL.
+ *
+ * ***** END LICENSE BLOCK ***** */
+
+function run_test() {
+  try {
+    var histsvc = Cc["@mozilla.org/browser/nav-history-service;1"].
+                  getService(Ci.nsINavHistoryService);
+    var bmsvc = Cc["@mozilla.org/browser/nav-bookmarks-service;1"].
+              getService(Ci.nsINavBookmarksService);
+  } catch(ex) {
+    do_throw("Unable to initialize Places services");
+  }
+
+
+  // add a visit
+  var testURI = uri("http://test");
+  histsvc.addVisit(testURI, Date.now() * 1000, null,
+                   histsvc.TRANSITION_TYPED, false, 0);
+
+  // query for the visit
+  var options = histsvc.getNewQueryOptions();
+  options.maxResults = 1;
+  options.resultType = options.RESULTS_AS_URI;
+  var query = histsvc.getNewQuery();
+  query.uri = testURI;
+  var result = histsvc.executeQuery(query, options);
+  var root = result.root;
+
+  // check hasChildren while the container is closed
+  do_check_eq(root.hasChildren, true);
+
+  // now check via the saved search path
+  var queryURI = histsvc.queriesToQueryString([query], 1, options);
+  bmsvc.insertBookmark(bmsvc.toolbarFolder, uri(queryURI),
+                       0 /* first item */, "test query");
+
+  // query for that query
+  var options = histsvc.getNewQueryOptions();
+  var query = histsvc.getNewQuery();
+  query.setFolders([bmsvc.toolbarFolder], 1);
+  var result = histsvc.executeQuery(query, options);
+  var root = result.root;
+  root.containerOpen = true;
+  var queryNode = root.getChild(0);
+  do_check_eq(queryNode.title, "test query");
+  queryNode.QueryInterface(Ci.nsINavHistoryContainerResultNode);
+  do_check_eq(queryNode.hasChildren, true);
+}