I think I found the preference responsible for the bug: browser.uiCustomization.state.
If you can locate your profile directory, open prefs.js and delete the corresponding line.
Eg on a local profile it was
user_pref("browser.uiCustomization.state", "{\"placements\":{\"widget-overflow-fixed-list\":[]},\"seen\":[\"developer-button\",\"profiler-button\"],\"dirtyAreaCache\":[],\"currentVersion\":16,\"newElementCount\":0}");