Comment 33 for bug 1111470

Hm, one change to think of would be 2e2fb75475c2fc74c98100f1468c8195fee49f3b
  xen/setup: Populate freed MFNs from non-RAM E820 entries and gaps to E820 RAM

That would be in with v3.5-rc3. A final proof usually needs to bisect it. To narrow down the attempts there you could try various kernels from http://kernel.ubuntu.com/~kernel-ppa/mainline/. If it really was the change above, then a v3.5-rc2 would crash and a -rc3 would boot. Though usually one is not so lucky and the fix is in a -rc1, that is most things... :)