nsITransferable.init() could potentially leak data in private mode

Calling `nsITransferable.init()` with a null first argument has the potential to leak data across private browsing mode sessions. `null` is  appropriate only when reading data or writing data which is not associated with a particular window.  File common/content/util.js#L667
