issues with DHE group parameter selection (PFS is not yet a panacea)

But NSS does fail open at a 512-bit DH group (that's where the ssl_error_weak_server_ephemeral_dh_key cutoff appears to be from brief testing). A DH group of 512 bits is considered roughly equivalent in strength to a 512-bit RSA key. For comparison, RSA-155 (an example 512-bit composite generated in 1991) was factored in 1999, and it seems likely that powerful adversaries today have a wee bit more computational capacity (moore's law suggests that there have been roughly 9 doublings of compute power since 1999, and the NSA is probably proportionally better equipped today than Herman te Riele was then, even after "adjusting for inflation"). If you're worried about the NSA, it seems likely that they have the capability to break any given 512-bit DLP secret key in a short period of time if they decide to throw some hardware and electricity at it.

Since we're talking about PFS, successful cracking only gains the attacker access to a single session, and not to an entire archive of cracked traffic; but if that particular session is considered valuable or interesting, and the DHE group used was 512 bits, the session's confidentiality is probably not going to resist a determined attacker for long.