I've looked through the Webcore source to see how they deal with this problem.  
It appears that they don't store or use a pointer to the original nodeimpl in 
JSLazyEventListener; the important difference is that in parseCode() the 
following chunk of code is omitted:

if (originalNode)
{
// Add the event's home element to the scope
// (and the document, and the form - see KJS::HTMLElement::eventHandlerScope)
  ScopeChain scope = listener.scope();
  Object thisObj = Object::dynamicCast(getDOMNode(exec, originalNode));
  if (thisObj.isValid()) {
    static_cast<DOMNode*>(thisObj.imp())->pushEventHandlerScope(exec, scope);
    listener.setScope(scope);
  }
}

Removing it causes http://cis.strath.ac.uk/~ac/remangle2.html to no longer 
crash Konqueror.  But, the code is obviously there for a reason; any offers?

Thanks,

Andrew