Inspect crash problems

CrashTest.as

package
{
	import flash.display.Sprite;
	import flash.events.MouseEvent;
	import flash.text.TextField;
	
	/**
	 * CONTEXT:
	 * I'm experiencing some weird crashes with the Flash Player 11.4
	 * that won't happen in the debug version of the same.
	 * 
	 * I've narrowed down the problem to be in relation to the _rest_ parameter
	 * used in the function arguments. The crash just won't happen when using a 
	 * regular array instead of _rest_ parameter.
	 * 
	 */
	public class PepperTest extends Sprite
	{
		private var t:TextField;
		private var b:Sprite;
		
		public function PepperTest()
		{
			b = addChild(new Sprite()) as Sprite;
			b.graphics.beginFill(0xcc0000);
			b.graphics.drawRect(20,20,100,50);
			b.graphics.endFill();
			b.addEventListener(MouseEvent.CLICK, onClick);
				
			t = addChild(new TextField()) as TextField;
			t.width = 200;
			t.height = 50;
			t.x = 150;
		}
		
		protected function onClick(event:MouseEvent):void
		{
			t.text = substitute("hello {0} {1}", "world", "!");
		}
		
		public /*static*/ function substitute(str:String, ... rest):String
		{
			var words:Array = (rest.length == 1 && rest[0] is Array) ? rest[0] as Array : rest;
			
			// on way to avoid the crash is removing the casting
			//var args:Array = (rest.length == 1 && rest[0] is Array) ? rest[0] : rest;
			
			// another is to just call a trace on rest (won't work if tracing something else ... WTF!)
			//trace(rest) 
			
			for (var i:int = 0; i < words.length; i++) 
			{
				str = str.replace(new RegExp("\\{"+i+"\\}", "g"), words[i]);
			}
			
			// also, the crash doesn't happen if i use the rest parameter directly in the for-loop, without the "words" variable
			
			return str;
		}
	}
}