When a bug is reproducible by a community member, but not on a developer's computer, a last-resort strategy is to debug it on the community member's computer. The crash victim should at least know how to run a debugger, if not how to use it, and should have a debug build of Firefox handy.
This requires quite a bit of trust, in both directions. The developer trusts that his time is not being wasted: the crash is a real bug in Firefox. (That is, there's a legitimate reason it happens only on some computers, but that reason just hasn't been discovered.) The crash victim, in turn, trusts the developer with full access to his computer.
A good place to start is a detailed stack (in gdb, use bt followed by bt full). There give more information about the stack than a Breakpad crash report: not only the names of the functions on the stack, but also the values they were passed.
A core dump includes all of the memory of a crashed program. It allows you to see the crash in a debugger even after the program has long exited.
Transferring a core dump is tricky, because it is large and can contain private information.
To generate a core dump on Mac, type "ulimit -c unlimited", run Firefox from the command line, and make Firefox crash. When Firefox crashes, a core will be placed in /Cores. You can then load the core file into gdb (gdb firefox-bin corefile), and it will be as if you caught the crash while running Firefox under gdb!
When transferring a Mac or Linux core dump, you'll also have to transfer the Firefox executable (and maybe more).
On Windows you can produce a "minidump". See here for instructions on how to do so with Microsoft's free debugger, WinDBG.
Explain in the bug that you have a core file or can reproduce the crash as many times as needed. The developer can give you appropriate commands to type into the debugger.
Examples: 367650, 374356, 393325, 418139
Find the developer on IRC and explain that you've caught the bug in a debugger. Since debugging usually requires printing many objects, this is much faster than debugging over Bugzilla. Use pastebin.mozilla.org for anything too long to paste into IRC.
Examples: 391851
Offer to let a developer control your computer using Remote desktop software such as VNC or Fog Creek Copilot.
If you happen to live in Mountain View, California, you can probably hand your laptop to a Mozilla developer for a bit.
Examples: 496391, 476241