The short answer

No, it's probably not malevolent. It appears Iceweasel writes its preferences file after every keystroke.

The long answer (how to find out)

The same thing happens here.

There is a way to determine exactly what's going on, by using the kernel's block-access dump feature. All of the below is done as root:

First, you need to stop the kernel logging daemon—otherwise, there will be lots of activity: writing the kernel log to disk. On my machine, it's part of rsyslog, so I do:

# /etc/init.d/rsyslog stop
[ ok ] Stopping enhanced syslogd: rsyslogd.

Now, in another terminal, cat /proc/kmsg. This will spit out the kernel logs, without writing them to disk.

Finally, echo 1 > /proc/sys/vm/block_dump to turn the block dump feature on. You should fairly quickly see output in the cat terminal, at least one line for each time the disk light blinks.

If there are far too many lines (there are here, because of a bunch of stuff running) you can use grep to filter them. E.g., you could use grep 'dirtied inode' /proc/kmsg or grep iceweasel /proc/kmsg

Then go ahead and type in the preferences box to see what disk activity there is. Once you've found out, run echo 0 > /proc/sys/vm/block_dump to turn off the block dump, and start back up your kernel logger (/etc/init.d/rsyslog start here)

Here is what I got:

<7>[618256.942332] iceweasel(4055): dirtied inode 563662 (prefs-1.js) on dm-3
<7>[618256.946971] iceweasel(4055): WRITE block 104158720 on dm-3 (280 sectors)
<7>[618256.946984] iceweasel(4055): WRITE block 1953005758 on sda3 (8 sectors)
<7>[618256.946988] iceweasel(4055): WRITE block 1953005758 on sdd3 (8 sectors)
<7>[618256.946991] iceweasel(4055): WRITE block 1953005758 on sdb3 (8 sectors)
<7>[618256.946994] iceweasel(4055): WRITE block 1953005758 on sdc3 (8 sectors)
<7>[618258.588306] iceweasel(4055): dirtied inode 563720 (prefs-1.js) on dm-3
<7>[618258.592806] iceweasel(4055): WRITE block 104081920 on dm-3 (280 sectors)
<7>[618258.621531] iceweasel(4055): WRITE block 1953005758 on sda3 (8 sectors)
<7>[618258.621536] iceweasel(4055): WRITE block 1953005758 on sdd3 (8 sectors)
<7>[618258.621539] iceweasel(4055): WRITE block 1953005758 on sdb3 (8 sectors)
<7>[618258.621541] iceweasel(4055): WRITE block 1953005758 on sdc3 (8 sectors)
⋮

So, what's happening is that every time you type in that field, Iceweasel immediately writes it to the preferences file. Then, on my system, it passes through LVM (the dm-3 stuff) an becomes a physical write to 4 disks (due to mdraid).

For all users on your machine: writing to /usr/bin

The script itself suggests a method for providing an alternative to iceweasel. I presume that the script is called /usr/bin/firefox. Thus, the line

FIREFOX="$(which $0)"

would set FIREFOX to /usr/bin/firefox. Thus, $FIREFOX.real would be /usr/bin/firefox.real. The line

[ -x "$FIREFOX.real" ] && exec "$FIREFOX.real" "$@"

looks to see if an executable with a .real suffix exists and runs that. If it doesn't find it, it falls back to iceweasel. Thus, to bypass iceweasel you need to create firefox.real:

sudo ln -sT "$location_to_firefox" /usr/bin/firefox.real

Note that root privileges are required to write to /usr/bin.

Just for yourself: writing to ~/bin

If you downloaded firefox into your home directory somewhere, use this method. Debian is set up by default so that if you have a bin directory in your $HOME directory, it will prepend it to your path. Thus all you have to do is:

mkdir -p ~/bin && ln -sT "$location_to_firefox" ~/bin/firefox

Once that symlink is in place it will override /usr/bin/firefox. Log out and back in for the changes to take effect. To confirm, run command -v firefox and make sure it prints the path to the firefox in your ~/bin directory.