diff --git a/content/xul/document/src/nsXULContentSink.cpp b/content/xul/document/src/nsXULContentSink.cpp
index a6e7534e739d..f7a8083bc80c 100644
--- a/content/xul/document/src/nsXULContentSink.cpp
+++ b/content/xul/document/src/nsXULContentSink.cpp
@@ -1386,12 +1386,6 @@ XULContentSinkImpl::OpenTag(const PRUnichar** aAttributes,
 {
     nsresult rv;
 
-    if (aNodeInfo->Equals(kScriptAtom, kNameSpaceID_HTML) || 
-        aNodeInfo->Equals(kScriptAtom, kNameSpaceID_XUL)) {
-        // Oops, it's a script!
-        return OpenScript(aAttributes, aLineNumber);
-    }
-
     // Create the element
     nsXULPrototypeElement* element;
     rv = CreateElement(aNodeInfo, &element);
@@ -1417,17 +1411,24 @@ XULContentSinkImpl::OpenTag(const PRUnichar** aAttributes,
         return rv;
     }
 
+    // Add the attributes
+    rv = AddAttributes(aAttributes, aAttrLen, element);
+    if (NS_FAILED(rv)) return rv;
+
     children->AppendElement(element);
 
+    if (aNodeInfo->Equals(kScriptAtom, kNameSpaceID_HTML) || 
+        aNodeInfo->Equals(kScriptAtom, kNameSpaceID_XUL)) {
+        // Do scripty things now.  OpenScript will push the
+        // nsPrototypeScriptElement onto the stack, so we're done after this.
+        return OpenScript(aAttributes, aLineNumber);
+    }
+
     // Push the element onto the context stack, so that child
     // containers will hook up to us as their parent.
     rv = mContextStack.Push(element, mState);
     if (NS_FAILED(rv)) return rv;
 
-    // Add the attributes
-    rv = AddAttributes(aAttributes, aAttrLen, element);
-    if (NS_FAILED(rv)) return rv;
-
     mState = eInDocumentElement;
     return NS_OK;
 }
diff --git a/content/xul/document/src/nsXULDocument.cpp b/content/xul/document/src/nsXULDocument.cpp
index 1769f6fec021..4baeecc9d95a 100644
--- a/content/xul/document/src/nsXULDocument.cpp
+++ b/content/xul/document/src/nsXULDocument.cpp
@@ -90,6 +90,7 @@
 #include "nsIDocumentObserver.h"
 #include "nsIFormControl.h"
 #include "nsIHTMLContent.h"
+#include "nsHTMLAtoms.h"
 #include "nsIElementFactory.h"
 #include "nsIEventStateManager.h"
 #include "nsIInputStream.h"
@@ -6303,6 +6304,12 @@ nsXULDocument::CreateOverlayElement(nsXULPrototypeElement* aPrototype, nsIConten
     rv = nsXULElement::Create(aPrototype, this, PR_FALSE, getter_AddRefs(element));
     if (NS_FAILED(rv)) return rv;
 
+    if (aPrototype->mNodeInfo->Equals(nsHTMLAtoms::script, kNameSpaceID_XUL) || 
+        aPrototype->mNodeInfo->Equals(nsHTMLAtoms::script, kNameSpaceID_HTML)) {
+        // <script> tags in an overlay don't need a forward reference.
+        return NS_OK;
+    }
+    
     OverlayForwardReference* fwdref = new OverlayForwardReference(this, element);
     if (! fwdref)
         return NS_ERROR_OUT_OF_MEMORY;
@@ -6316,7 +6323,6 @@ nsXULDocument::CreateOverlayElement(nsXULPrototypeElement* aPrototype, nsIConten
     return NS_OK;
 }
 
-
 nsresult
 nsXULDocument::AddAttributes(nsXULPrototypeElement* aPrototype, nsIContent* aElement)
 {