In your x86 paging code, you have page tables permanently mapped in (by pointing a PDE to the page directory). In X86VirtualAddressSpace::revertToKernelAddressSpace, you clear out old pages and page tables, however when you clear the page directory entry to remove a page table, you don't invalidate the TLB entry for the virtual address that maps that page table in, so later if a new page table is mapped in, the TLB entry for the virtual page table address may still point to the old page table that was mapped there.
Seeing this makes it seem pretty certain that this is the problem:
Code:
/// \note I'm now getting a page fault during execve (MemoryMappedFile::trap) that occurs only
/// when these lines are kept in. I've left them here because they're correct. - Matt
// PhysicalMemoryManager::instance().freePage(PAGE_GET_PHYSICAL_ADDRESS(pageDirectoryEntry));
// *pageDirectoryEntry = 0;