> that it can be crashed (or self destruct bug, insert your own word here) by a remote server at any time.

It isn't by design that syncing can affect the whole browser; it's a bug in the syncing code which should have been handled. There is no self destruct bug, and calling it that is incorrect. Are you aware of the fix?

http://src.chromium.org/viewvc/chrome/trunk/src/sync/engine/...

The fix is just checking if the model is valid before making the call which was throwing the out of bound exception.