diff --git a/browser/components/safebrowsing/content/list-warden.js b/browser/components/safebrowsing/content/list-warden.js
index ce3c2303572b..059b7fdba603 100644
--- a/browser/components/safebrowsing/content/list-warden.js
+++ b/browser/components/safebrowsing/content/list-warden.js
@@ -207,6 +207,7 @@ MultiTableQuerier.prototype.run = function() {
 
     // Break circular ref to callback.
     this.evilCallback_ = null;
+    this.listManager_ = null;
   }
 }
 
@@ -218,8 +219,13 @@ MultiTableQuerier.prototype.whiteTableCallback_ = function(isFound) {
   //G_Debug(this, "whiteTableCallback_: " + isFound);
   if (!isFound)
     this.run();
-  else
+  else {
     G_Debug(this, "Found in whitelist: " + this.url_)
+
+    // Break circular ref to callback.
+    this.evilCallback_ = null;
+    this.listManager_ = null;
+  }
 }
 
 /**
@@ -234,5 +240,9 @@ MultiTableQuerier.prototype.blackTableCallback_ = function(isFound) {
     // In the blacklist, must be an evil url.
     G_Debug(this, "Found in blacklist: " + this.url_)
     this.evilCallback_();
+
+    // Break circular ref to callback.
+    this.evilCallback_ = null;
+    this.listManager_ = null;
   }
 }
diff --git a/browser/components/safebrowsing/content/phishing-warden.js b/browser/components/safebrowsing/content/phishing-warden.js
index 439c8dff63e5..6f4c5fbb227e 100644
--- a/browser/components/safebrowsing/content/phishing-warden.js
+++ b/browser/components/safebrowsing/content/phishing-warden.js
@@ -148,6 +148,7 @@ PROT_PhishingWarden.prototype.QueryInterface = function(iid) {
 PROT_PhishingWarden.prototype.shutdown = function() {
   this.progressListener_.callback = null;
   this.progressListener_ = null;
+  this.listManager_ = null;
 }
 
 /**
diff --git a/browser/components/safebrowsing/content/sb-loader.js b/browser/components/safebrowsing/content/sb-loader.js
index b8f4f3a4c9c4..9f675d3217a6 100644
--- a/browser/components/safebrowsing/content/sb-loader.js
+++ b/browser/components/safebrowsing/content/sb-loader.js
@@ -101,6 +101,7 @@ var safebrowsing = {
     // so we need to check all requests that fired before deferredStartup.
     if (!phishWarden.phishWardenEnabled_) {
       safebrowsing.progressListenerCallback.requests = null;
+      safebrowsing.progressListenerCallback.onDocNavStart = null;
       safebrowsing.progressListenerCallback = null;
       safebrowsing.progressListener = null;
       return;
@@ -115,6 +116,7 @@ var safebrowsing = {
     }
     // Cleanup
     safebrowsing.progressListenerCallback.requests = null;
+    safebrowsing.progressListenerCallback.onDocNavStart = null;
     safebrowsing.progressListenerCallback = null;
     safebrowsing.progressListener = null;
   },
diff --git a/browser/components/safebrowsing/src/nsDocNavStartProgressListener.cpp b/browser/components/safebrowsing/src/nsDocNavStartProgressListener.cpp
index 28397ff71195..4a33558da60b 100644
--- a/browser/components/safebrowsing/src/nsDocNavStartProgressListener.cpp
+++ b/browser/components/safebrowsing/src/nsDocNavStartProgressListener.cpp
@@ -71,6 +71,8 @@ nsDocNavStartProgressListener::~nsDocNavStartProgressListener()
   }
 
   mTimers.Clear();
+  
+  mCallback = nsnull;
 }
 
 // nsDocNavStartProgressListener::AttachListeners
diff --git a/toolkit/components/url-classifier/content/trtable.js b/toolkit/components/url-classifier/content/trtable.js
index 503b14aacc69..6c5c8c252658 100644
--- a/toolkit/components/url-classifier/content/trtable.js
+++ b/toolkit/components/url-classifier/content/trtable.js
@@ -79,19 +79,30 @@ UrlClassifierTableUrl.prototype.exists = function(url, callback) {
 
   var dbservice_ = Cc["@mozilla.org/url-classifier/dbservice;1"]
                    .getService(Ci.nsIUrlClassifierDBService);
+  var callbackHelper = new UrlLookupCallback(callback);
   dbservice_.exists(this.name,
                     canonicalized,
-                    BindToObject(this.dbCallback_, 
-                                 this,
-                                 callback));
+                    BindToObject(callbackHelper.dbCallback,
+                                 callbackHelper));
 }
 
 /**
- * For the url table, we only need to check if the return value is a non-empty
- * string.
+ * A helper class for handling url lookups in the database.  This allows us to
+ * break our reference to callback to avoid memory leaks.
+ * @param callback nsIUrlListManagerCallback
  */
-UrlClassifierTableUrl.prototype.dbCallback_ = function(callback, value) {
-  callback.handleEvent(value.length > 0);
+function UrlLookupCallback(callback) {
+  this.callback_ = callback;
+}
+
+/**
+ * Callback function from nsIUrlClassifierDBService.exists.  For url lookup,
+ * any non-empty string value is a database hit.
+ * @param value String
+ */
+UrlLookupCallback.prototype.dbCallback = function(value) {
+  this.callback_.handleEvent(value.length > 0);
+  this.callback_ = null;
 }
 
 /////////////////////////////////////////////////////////////////////