This option seems to indicate to me that there must be some of check for what is/is-not a “web forgery”. Is FF calling home to check the site? If so it might be a slow network connection to that resource (or slow check internally if they carry a list around with the install)?
[edit] - I just checked and it does look like a combo of a downloaded list (every 30 minutes they download a new list?!) as well as metadata checking against Google.