Where does Firefox store the opened windows/tabs/URLs for session restore after a crash?

It's in sessionstore.js in your profile directory. It can be moved to a different profile without problem.

(This might also show sessionstore.bak, which is a backup of the previous version of that file.)

Arjan's answer is still mostly correct, but Firefox now stores current windows and tabs in sessionstore.jsonlz4. This file is in a non-standard compressed form; see this answer for details and ways to decompress it (I had luck using this tool).

Additionally, Firefox only creates this file when exiting, so it will not exist on disk while the relevant profile is in use by a running instance of Firefox. That said, backups of sessionstore.jsonlz4 are kept in .../<profile>/sessionstore-backups/. In my case there are six backups in here of varying names, so I would fall back to the modification time of these files to identify the most recent.

Finally, none of this applies to Android. The "sessionstore" files do not exist, and Firefox instead keeps a tab list in /data/data/org.mozilla.firefox/files/mozilla_components_session_storage_gecko.json. Notably, this is not inside the profile directory. This file is not compressed like the .jsonlz4 files. As far as I can tell, there are no automatic backups kept of this file.