It seems that Safari 8.0.3 on OS 10.10.2 is also affected by the PNG bug.
Although it has a variable number of variants each time the page is open/refreshed (don't have access to a vulnerable IE to test if it has the same behaviour)
It might be the case that the variants aren't exploitable – Safari uses CoreImage and that framework tends to bend over backwards to support malformed images so I wouldn't be surprised to see it render differently for each slightly different test image even if none of them are exploitable.
But isn't the idea here that all the "variants" are actually the same exact .png byte stream? So any differences are the result of leaking memory...?
You're right – the random call is just a dodge around caching. It could be leaked memory or possibly something like an address dependency but I'd hope that he submitted it to Apple along with the other browsers he's been testing.
It's also acting up in iOS on mobile safari. And, even more interestingly, if you long-tap a few of the images and save them to the photo stream, you'll see them change "live" in lots of applications like the photo browser, photo editors, pasting in an iMessage, etc.