The fix for bug 292789 has landed. This bug also affects chrome XBL applied to web pages from chrome JS. So look at the contentaccessible tweak for chrome manifests Wladimir is detailing on his blog. Just one minor comment : when Wladimir writes

If for some reason an extension needs its files to be accessible from the web, it can specify the flag contentaccessible=yes in chrome.manifest — but that should be a rare exception.

I tend to disagree with that "rare exception". I think we're going to see more and more extensions tweaking one way or another the content coming from the wire for a better user experience on the Web... Apply a stylesheet, add an icon, apply an XBL, etc. All these need chrome access from the web page.