Sometimes I could not login JDS/Gnome with a11y feature on.
The chance to reproduce is about 10%-20%.

The splash window is always there.
I can use gnome-panel and the start menu there, but I can't start any program, or logout JDS.
I couldn't input anything with the keyboard.

The system is hang, I can login from another computer and pkill -9 gnome-session.
If I don't have another computer around, the only wayout I know is to use Menu->All Applications->Run Application... and then select /usr/dt/sdtprocess by mouse.

The stack of /usr/lib/at-spi-registryd is,
3680:   /usr/lib/at-spi-registryd
 ff2c9980 pollsys  (681e0, 18, 0, 0)
 ff275bec poll     (681e0, 18, ffffffff, ff072a00, ff0653f8, 0) + 7c
 fefc29d8 g_main_context_poll (33088, ffffffff, 18, 681e0, 18, ff0633fc) + 120
 fefc1b5c g_main_context_iterate (681e0, 1, 1, 33088, 18, 18) + 474
 fefc1e08 g_main_context_iteration (33088, 1, ff0653f8, 33088, 1, 10) + c4
 fef2492c giop_recv_buffer_get (ffbfdad0, ffbfdae8, 114, 2d518, fef63b3c, ff0653f8) + 90
 fef28f50 ORBit_small_invoke_stub (0, ff1845e0, 0, 0, 0, ffbfdca4) + 174
 fef3e7c0 ORBit_c_stub_invoke (5f700, ff1846a8, 0, 0, 0, 0) + a4
 ff16a570 Bonobo_Unknown_ref (5f700, ffbfdca4, d4, 19484, 0, ff183990) + 68
 fed2b218 bonobo_object_dup_ref (5f700, ffbfdca4, 60d18, 5, 3, 5f700) + 58
 000157b0 spi_desktop_add_application (35690, 5f700, 37418, 2faf0, 1d8b4, feef034c) + 64
 00019108 impl_accessibility_registry_register_application (3742c, 5f700, ffbfdf2c, ffbfdd78, ffbfdf2c, 190ec) + 1c
 fef29768 ORBit_small_invoke_adaptor (56ef0, 60f38, 0, ffbfdd88, ffbfdf2c, ff1eeaf0) + 438
 fef3abfc ORBit_POAObject_handle_request (56ef0, 62c04, 0, 0, 0, 60f38) + 424
 fef3ade4 ORBit_POAObject_invoke_incoming_request (56ef0, 60f38, ffbfdf2c, 0, 1e554, 0) + 54
 fef3b3a4 ORBit_POA_handle_request (0, 60f38, 60f50, ffbfdf2c, 0, ff0653fc) + 32c
 fef4001c ORBit_handle_request (33ca8, 60f38, 33ca8, 62bd8, 23b68, fef3b078) + 4c
 fef25974 giop_connection_handle_input (5f0a8, 60f38, 278, 0, 0, fef256f8) + 25c
 fef47f38 link_connection_io_handler (0, 1, 5f0a8, 1, 571f0, 1) + 4c
 fefbffbc g_main_dispatch (33088, 0, 2, 0, ff0633fc, 33090) + 1e4
 fefc1664 g_main_context_dispatch (1, 1, ff0653f4, 3, ff0653f8, 33088) + c8
 fefc1b84 g_main_context_iterate (1, 1, 1, 33088, 12, 11) + 49c
 fefc1e08 g_main_context_iteration (33088, 1, ff0653f8, 33088, 1, 10) + c4
 fef2492c giop_recv_buffer_get (ffbfe2e0, ffbfe2f8, 114, 2d518, fef63b3c, ff0653f8) + 90
 fef28f50 ORBit_small_invoke_stub (0, ff184620, 0, 0, 0, ffbfe43c) + 174
 fef3e7c0 ORBit_c_stub_invoke (642b8, ff1846a8, 1, 0, 0, 0) + a4
 ff16a5e8 Bonobo_Unknown_unref (642b8, ffbfe43c, d4, 1940c, 0, ff183990) + 68
 fed2b254 bonobo_object_release_unref (642b8, 0, ff355d40, ffbfe43c, a, 642b8) + 28
 000199ec registry_flush_event_queue (37418, 0, ffbfe79c, 4f538, 4b, 2b000) + 90
 00019cf0 registry_filter_event (1, ffbfe570, ffbfe79c, ff072a00, e6548, 0) + b4
 00019d58 impl_registry_notify_event (3742c, 65f48, ffbfe79c, 1, 2b400, 2b410) + 50
 fef29768 ORBit_small_invoke_adaptor (56ef0, 60a00, 0, ffbfe5f8, ffbfe79c, ff1eaed0) + 438
 fef3abfc ORBit_POAObject_handle_request (56ef0, 6e774, 0, 0, 0, 60a00) + 424
 fef3ade4 ORBit_POAObject_invoke_incoming_request (56ef0, 60a00, ffbfe79c, 0, 1e554, 0) + 54
 fef3b3a4 ORBit_POA_handle_request (0, 60a00, 60a18, ffbfe79c, 0, ff0653fc) + 32c
 fef4001c ORBit_handle_request (33ca8, 60a00, 33ca8, 6e748, 23b68, fef3b078) + 4c
 fef25974 giop_connection_handle_input (37960, 60a00, 278, 0, 0, fef256f8) + 25c
 fef47f38 link_connection_io_handler (0, 1, 37960, 1, 571f0, 1) + 4c
 fefbffbc g_main_dispatch (33088, 0, 1, 0, ff0633fc, 33090) + 1e4
 fefc1664 g_main_context_dispatch (1, 1, ff0653f4, 2, ff0653f8, 33088) + c8
 fefc1b84 g_main_context_iterate (1, 1, 1, 33088, f, f) + 49c
 fefc1e08 g_main_context_iteration (33088, 1, ff0653f8, 33088, 1, 10) + c4
 fef2492c giop_recv_buffer_get (ffbfeb50, ffbfeb68, 114, 2d518, fef63b3c, ff0653f8) + 90
 fef28f50 ORBit_small_invoke_stub (0, ff1845e0, 0, 0, 0, ffbfed24) + 174
 fef3e7c0 ORBit_c_stub_invoke (6b9c8, ff1846a8, 0, 0, 0, 0) + a4
 ff16a570 Bonobo_Unknown_ref (6b9c8, ffbfed24, d4, 19484, 0, ff183990) + 68
 fed2b218 bonobo_object_dup_ref (6b9c8, ffbfed24, 5eb60, 4, 3, 6b9c8) + 58
 000157b0 spi_desktop_add_application (35690, 6b9c8, 37418, 2faf0, 1d8b4, feef034c) + 64
 00019108 impl_accessibility_registry_register_application (3742c, 6b9c8, ffbfefac, ffbfedf8, ffbfefac, 190ec) + 1c
 fef29768 ORBit_small_invoke_adaptor (56ef0, 60208, 0, ffbfee08, ffbfefac, ff1eeaf0) + 438
 fef3abfc ORBit_POAObject_handle_request (56ef0, 65d4c, 0, 0, 0, 60208) + 424
 fef3ade4 ORBit_POAObject_invoke_incoming_request (56ef0, 60208, ffbfefac, 0, 1e554, 0) + 54
 fef3b3a4 ORBit_POA_handle_request (0, 60208, 60220, ffbfefac, 0, ff0653fc) + 32c
 fef4001c ORBit_handle_request (33ca8, 60208, 33ca8, 65d20, 23b68, fef3b078) + 4c
 fef25974 giop_connection_handle_input (37b40, 60208, 278, 0, 0, fef256f8) + 25c
 fef47f38 link_connection_io_handler (0, 1, 37b40, 1, 571f0, 1) + 4c
 fefbffbc g_main_dispatch (33110, 0, 0, 0, ff0633fc, 33118) + 1e4
 fefc1664 g_main_context_dispatch (1, 1, ff0653f4, 3, ff0653f8, 33110) + c8
 fefc1b84 g_main_context_iterate (1, 1, 1, 33110, 11, 10) + 49c
 fefc2488 g_main_loop_run (5a928, 0, fed68ea8, 30418, 5a930, 1) + 3e4
 fed25c4c bonobo_main (0, fed6ac34, fed68ea8, 1d8c, 432c0, 1c00) + 68
 00018d8c main     (1a400, ffbffa9a, 0, 37418, 1a400, 1a400) + c4
 00014e20 _start   (0, 0, 0, 0, 0, 0) + 108

The stack of gnome-session is,

3665:   /usr/bin/gnome-session
-----------------  lwp# 1 / thread# 1  --------------------
 ff2c9980 pollsys  (aa0d8, 7, 0, 0)
 ff275bec poll     (aa0d8, 7, ffffffff, ff372a00, ff0e53f8, 0) + 7c
 ff0429d8 g_main_context_poll (68600, ffffffff, 7, aa0d8, 7, ff0e33fc) + 120
 ff041b5c g_main_context_iterate (aa0d8, 1, 1, 68600, 7, 7) + 474
 ff041e08 g_main_context_iteration (68600, 1, ff0e53f8, 68600, 1, 10) + c4
 fb22492c giop_recv_buffer_get (ffbfde58, ffbfde70, 114, 4f630, fb263b3c, ff0e53f8) + 90
 fb228f50 ORBit_small_invoke_stub (0, fa92aed0, 0, ffbfdf54, 0, fa1c6020) + 174
 fb23e7c0 ORBit_c_stub_invoke (98108, fa92b01c, 0, 0, ffbfdf54, 0) + a4
 fa8ef35c Accessibility_EventListener_notifyEvent (98108, ffbfdfbc, fa1c6020, 64c, 38d08, 400) + 6c
 fa1b3d10 spi_atk_emit_eventv (b2120, 0, fa1c5fd0, ffbfe03c, fa1b5858, 20e580) + 200
 fa1b4be0 spi_atk_bridge_window_event_listener (ffbfe11c, fbb4416c, ffbfe288, 10d1c, fa1c5874, 10000) + 8c
 fefc8160 signal_emit_unlocked_R (fa1b4b54, 0, feff11a8, 97, ff0e5408, ff0e53f8) + 69c
 fefc7240 g_signal_emit_valist (b2120, 97, ffbfe2a0, ffbfe4b8, 9b860, feff11a8) + 784
 fefc7588 g_signal_emit (b2120, 97, 0, 18428, 18000, fa250c80) + 1c
 fefaf6cc g_closure_invoke (0, 0, 3, ffbfe6f8, ffbfe58c, 9b040) + 1a8
 fefc831c signal_emit_unlocked_R (1, 1, feff11a8, 78, ff0e5408, ff0e53f8) + 858
 fefc7240 g_signal_emit_valist (606f0, 1202, ffbfe710, ffbfe974, 90830, feff11a8) + 784
 fefc7a38 g_signal_emit_by_name (ff0e5400, fa23fea0, feff11a8, 78, 233, ff0e53f8) + 4a0
 fa230eac _gail_toplevel_remove_child (b2120, 0, 606f0, 1fe8c, fa250c80, 0) + bc
 fa230de0 gail_toplevel_hide_event_watcher (ffbfea94, 606f0, ffbfec00, 606f0, 100, af000) + 5c
 fefc8160 signal_emit_unlocked_R (fa230d84, 1, feff11a8, 1e, ff0e5408, ff0e53f8) + 69c
 fefc7240 g_signal_emit_valist (af000, 1e, ffbfec18, ffbfee30, 84998, feff11a8) + 784
 fefc7588 g_signal_emit (af000, 1e, 0, 39bc8, feff034c, 15000) + 1c
 fbaec5a0 gtk_widget_hide (af000, c6b4, c400, 1000, f99b0, ff0e5400) + d0
 fbaf45d0 gtk_widget_dispose (af000, fbbf2714, f18fc, fbbe5e84, eb430, af000) + 4c
 fefb2044 g_object_run_dispose (af000, 15000, af000, fbafaa50, 3e3cc, ae208) + c8
 00026958 splash_stop (2d8a8, 0, 4, 43400, 43400, af000) + 2c
 0001dd18 update_save_state (43400, 4, 43400, 43400, 43b64, 43800) + e8
 0001d074 register_client (1, 20f770, 0, 43400, 43400, 2dc00) + 31c
 fa1780c4 _SmsProcessMessage (216ef0, e0500, 1, 0, 4, 216974) + 5f8
 fab4bc48 IceProcessMessages (2175f0, 0, 0, 1, 0, 0) + 334
 fafcda88 process_ice_messages (203cd8, 1, 2175f0, 57254, fb024cc0, fafcda68) + 20
 ff03ffbc g_main_dispatch (66920, 0, 0, 0, ff0e33fc, 66928) + 1e4
 ff041664 g_main_context_dispatch (1, 1, ff0e53f4, 1, ff0e53f8, 66920) + c8
 ff041b84 g_main_context_iterate (1, 1, 1, 66920, 10, 10) + 49c
 ff042488 g_main_loop_run (9ed90, 0, 0, 67f60, 9ed98, 1) + 3e4
 fb9a7540 gtk_main (0, 0, 0, be3c, fbbf1cc0, 9ed90) + d8
 00020bb0 main     (9ed90, 2f400, 0, 69258, 0, 44) + 65c
 0001b7b0 _start   (0, 0, 0, 0, 0, 0) + 108
-----------------  lwp# 2 / thread# 2  --------------------
 ff2c9a94 read     (10, fb17bf2c, 14)
 ff044154 child_watch_helper_thread (ff0e5230, 68600, 0, ff0e53f4, ff0e5400, ff0e33fc) + 68
 ff06a710 g_thread_create_proxy (6e4d0, ff0e5470, ff2be124, ff0e5458, ff0440ec, ff0e5430) + 194
 ff2c5120 _lwp_start (0, 0, 0, 0, 0, 0)