Intent matters. You won't get in trouble for exploiting buffer overflows while taking a computer security class, but you sure would if you used it against someone maliciously. (And, like it or not, intentionally crashing someone's browser is malicious (and the intent is not hard to prove, given that it's done with $.crash).)