Can ECC correctness issues allow “remote attackers to spoof ECDSA signatures”?
Glancing through the Mozilla notes, it would appear that it would actually be infeasible to generate a forged signature (that is, not involving the private key) that would tickle this bug.  In fact, if someone could generate a signature that would tickle this bug, they could deduce the private key (and so wouldn't need exploit this implementation flaw).

During ECDSA signature generation, the verifier creates two EC points $u_1 G$ and $u_2 Q$, where $Q$ is the public key, and $u_1, u_2$ are two integers computed as a part of the verification problem.  The verification routine then adds these two points, apparently, the bug happens if either $u_1G = u_2Q$ (the addition is actually a point doubling), or if $u_1G = -u_2Q$ (the result of the addition is the neutral element).

However, if either is true, then $\pm u_2^{-1} u_1 G = Q$, and hence $\pm u_2^{-1} u_1$ is the private key.  Hence, if the attacker can generate a signature that satisfies either of these two conditions, he can compute $u_1, u_2$, and then directly recover the private key.  And, with the private key, the attacker can sign anything he wants.

Now, Mozilla was quite correct in fixing this bug; however it doesn't look like it's exploitable.