I've managed to track this down to the fact that thunderbird spawns firebird with /usr/lib/mozilla-thunderbird at the front of LD_LIBRARY_PATH. As a result the copy of libnss in there gets preference to firefox's and is presumably what causes the problem. Forcefully inserting /usr/lib to the front of LD_LIBRARY_PATH in the /usr/bin/firefox wrapper would be enough to work around this problem.
I've managed to track this down to the fact that thunderbird spawns firebird with /usr/lib/ mozilla- thunderbird at the front of LD_LIBRARY_PATH. As a result the copy of libnss in there gets preference to firefox's and is presumably what causes the problem. Forcefully inserting /usr/lib to the front of LD_LIBRARY_PATH in the /usr/bin/firefox wrapper would be enough to work around this problem.