I've audited all the places where we instantiate an XPCCallContext with more than just (cx, {NATIVE,JS}_CALLER), and the toString hook is the only place where we don't check IsValid() or something that depends on it.