It actually turned out to be only SDK versions older than 1.4, which account for fewer than 500 add-ons (including only about 100 that are "fully reviewed" and are displayed in search results): http://bugzil.la/751466

And not all of those 500 add-ons will be affected, since it only affects add-ons using specific APIs from those old SDKs. And if the cause of that leak is fixed soon, then only users of Firefox Nightly builds will ever have been affected.

That appears to be a bug in the approach we're using, and we think we have a fix for it.

This is great news. Any estimate on when these fixes might be released into a production version?

We're on track to ship this in late August.