diff --git a/docshell/base/nsDocShell.cpp b/docshell/base/nsDocShell.cpp
index 59efb574398e..c6a72a2647c2 100644
--- a/docshell/base/nsDocShell.cpp
+++ b/docshell/base/nsDocShell.cpp
@@ -86,6 +86,7 @@
 #include "nsAutoPtr.h"
 #include "nsIPrefService.h"
 #include "nsIWritablePropertyBag2.h"
+#include "nsObserverService.h"
 
 // we want to explore making the document own the load group
 // so we can associate the document URI with the load group.
@@ -3360,6 +3361,9 @@ nsDocShell::InitWindow(nativeWindow parentNativeWindow,
 NS_IMETHODIMP
 nsDocShell::Create()
 {
+    NS_ASSERTION(mItemType == typeContent || mItemType == typeChrome,
+                 "Unexpected item type in docshell");
+
     nsresult rv = NS_ERROR_FAILURE;
     mPrefs = do_GetService(NS_PREFSERVICE_CONTRACTID, &rv);
     NS_ENSURE_SUCCESS(rv, rv);
@@ -3385,12 +3389,32 @@ nsDocShell::Create()
     if (NS_SUCCEEDED(rv))
         mUseErrorPages = tmpbool;
 
+    nsCOMPtr<nsIObserverService> serv = do_GetService(NS_OBSERVERSERVICE_CONTRACTID);
+    if (serv) {
+        const char* msg = mItemType == typeContent ?
+            NS_WEBNAVIGATION_CREATE : NS_CHROME_WEBNAVIGATION_CREATE;
+        serv->NotifyObservers(GetAsSupports(this), msg, nsnull);
+    }    
+
     return NS_OK;
 }
 
 NS_IMETHODIMP
 nsDocShell::Destroy()
 {
+    NS_ASSERTION(mItemType == typeContent || mItemType == typeChrome,
+                 "Unexpected item type in docshell");
+
+    if (!mIsBeingDestroyed) {
+        nsCOMPtr<nsIObserverService> serv =
+            do_GetService(NS_OBSERVERSERVICE_CONTRACTID);
+        if (serv) {
+            const char* msg = mItemType == typeContent ?
+                NS_WEBNAVIGATION_DESTROY : NS_CHROME_WEBNAVIGATION_DESTROY;
+            serv->NotifyObservers(GetAsSupports(this), msg, nsnull);
+        }
+    }
+    
     mIsBeingDestroyed = PR_TRUE;
 
     //Fire unload event before we blow anything away.
diff --git a/docshell/base/nsWebShell.cpp b/docshell/base/nsWebShell.cpp
index 79ce73119350..575f3db9a2a0 100644
--- a/docshell/base/nsWebShell.cpp
+++ b/docshell/base/nsWebShell.cpp
@@ -1120,6 +1120,11 @@ nsWebShell::SelectNone(void)
 
 NS_IMETHODIMP nsWebShell::Create()
 {
+  if (mPrefs) {
+    // We've already been created
+    return NS_OK;
+  }
+  
   // Remember the current thread (in current and forseeable implementations,
   // it'll just be the unique UI thread)
   //
diff --git a/docshell/build/nsDocShellCID.h b/docshell/build/nsDocShellCID.h
index 10524e898ff9..48e4c87d71d8 100644
--- a/docshell/build/nsDocShellCID.h
+++ b/docshell/build/nsDocShellCID.h
@@ -49,4 +49,40 @@
 #define NS_WEBNAVIGATION_INFO_CONTRACTID \
     "@mozilla.org/webnavigation-info;1"
 
+/**
+ * An observer service topic that can be listened to to catch creation
+ * of content browsing areas (both toplevel ones and subframes).  The
+ * subject of the notification will be the nsIWebNavigation being
+ * created.  At this time the additional data wstring is not defined
+ * to be anything in particular.
+ */
+#define NS_WEBNAVIGATION_CREATE "webnavigation-create"
+
+/**
+ * An observer service topic that can be listened to to catch creation
+ * of chrome browsing areas (both toplevel ones and subframes).  The
+ * subject of the notification will be the nsIWebNavigation being
+ * created.  At this time the additional data wstring is not defined
+ * to be anything in particular.
+ */
+#define NS_CHROME_WEBNAVIGATION_CREATE "chrome-webnavigation-create"
+
+/**
+ * An observer service topic that can be listened to to catch destruction
+ * of content browsing areas (both toplevel ones and subframes).  The
+ * subject of the notification will be the nsIWebNavigation being
+ * destroyed.  At this time the additional data wstring is not defined
+ * to be anything in particular.
+ */
+#define NS_WEBNAVIGATION_DESTROY "webnavigation-destroy"
+
+/**
+ * An observer service topic that can be listened to to catch destruction
+ * of chrome browsing areas (both toplevel ones and subframes).  The
+ * subject of the notification will be the nsIWebNavigation being
+ * destroyed.  At this time the additional data wstring is not defined
+ * to be anything in particular.
+ */
+#define NS_CHROME_WEBNAVIGATION_DESTROY "chrome-webnavigation-destroy"
+
 #endif // nsDocShellCID_h__
diff --git a/xpfe/appshell/src/nsWebShellWindow.cpp b/xpfe/appshell/src/nsWebShellWindow.cpp
index 175b85b2f370..b964883ea3dc 100644
--- a/xpfe/appshell/src/nsWebShellWindow.cpp
+++ b/xpfe/appshell/src/nsWebShellWindow.cpp
@@ -228,6 +228,15 @@ nsresult nsWebShellWindow::Initialize(nsIXULWindow* aParent,
   mDocShell = do_CreateInstance("@mozilla.org/webshell;1");
   NS_ENSURE_TRUE(mDocShell, NS_ERROR_FAILURE);
 
+  // Make sure to set the item type on the docshell _before_ calling
+  // Create() so it knows what type it is.
+  nsCOMPtr<nsIDocShellTreeItem> docShellAsItem(do_QueryInterface(mDocShell));
+  NS_ENSURE_TRUE(docShellAsItem, NS_ERROR_FAILURE);
+  NS_ENSURE_SUCCESS(EnsureChromeTreeOwner(), NS_ERROR_FAILURE);
+
+  docShellAsItem->SetTreeOwner(mChromeTreeOwner);
+  docShellAsItem->SetItemType(nsIDocShellTreeItem::typeChrome);
+
   r.x = r.y = 0;
   nsCOMPtr<nsIBaseWindow> docShellAsWin(do_QueryInterface(mDocShell));
   NS_ENSURE_SUCCESS(docShellAsWin->InitWindow(nsnull, mWindow, 
@@ -240,13 +249,6 @@ nsresult nsWebShellWindow::Initialize(nsIXULWindow* aParent,
     webProgress->AddProgressListener(this, nsIWebProgress::NOTIFY_STATE_NETWORK);
   }
 
-  nsCOMPtr<nsIDocShellTreeItem> docShellAsItem(do_QueryInterface(mDocShell));
-  NS_ENSURE_TRUE(docShellAsItem, NS_ERROR_FAILURE);
-  NS_ENSURE_SUCCESS(EnsureChromeTreeOwner(), NS_ERROR_FAILURE);
-
-  docShellAsItem->SetTreeOwner(mChromeTreeOwner);
-  docShellAsItem->SetItemType(nsIDocShellTreeItem::typeChrome);
-
   if (nsnull != aUrl)  {
     nsCAutoString tmpStr;