Ok nevermind I found an already existing issue. It worked by pure luck now, because we were leaking the principals. `GetPrincipal` does **not** AddRef the returned principal, yet we released it, in `create_nsxhr`.
This is probably also the reason I had to add a hack in Proton for FFXIV Launcher since I used similar logic in `create_nsdomparser`, and explains the crash when we weren't leaking the document, since the principal was released.
I'll add the fix to this MR since it's related and trivial fix in hindsight…