That is a question I hear more and more, and I felt it had to be answered publicly. Short answer: when it's ready.
The current target for Squeeze is 3.5, for various reasons, but the main is that it shares the same Gecko version as Iceape (SeaMonkey) and Icedove (Thunderbird), which means that while the security team (or myself) will have to update these three for security updates, they will share patches. So 3.6 is less a priority than having 3.5 in shape for the release.
Last week, I wrote on a mailing list post that I was expecting 3.6 to come this week. Well, that was before I discovered the sad reality about the state of the current version.
But 3.6 is still on the radar. I already went through all the patches we apply on 1.9.1, and rebasing should now be straightforward.
Most of the 3.5 failures have now also been addressed: sparc and powerpc were fixed first, and I am now (re-re-re...-re)building on arm for, I hope, the last time. Unfortunately, mips is still missing, and without a porterbox, I can't do much. I tried, some time ago, in qemu, but there is no way I'm going to wait 50 hours for a build again ; it was already painful on a real arm box (where it takes 90 minutes just to link libxul.so). Anyways, 2 patches stolen from upstream and 5 patches sent (or almost sent for the one currently under validation) later, we should be down to one release architecture failing instead of four. Which is already good.
On the other hand, a new 3.5 upstream release, with security fixes, is planned for next tuesday, which means some time will have to be spent for stable updates, too. So, in the next few days, expect that I'll be working on stable security updates, then unstable updates, including the three architectures fix, and then work on 3.6 will continue.
Which means we can hope for a 3.6 release in experimental by the end of next week, or the following one, in the worst case.
Update: *sigh* 4 patches on arm is not enough :(. At least this time I think I'm done with xptcinvoke and xptcstubs.
Update:In the end, 2 patches and disabling the JIT compiler did the trick on arm. The 2 other patches were actually addressing bugs that only existed because the JIT is doing something wrong with the stack alignment.