Thanks to Microsoft support, we've tracked this down to some sort of resource leak related to Windows file sharing. The web servers in question have a virtual directory mapped to a UNC file share on a media server, and - for reasons we don't entirely understand yet - file handles opened on this UNC share weren't being closed cleanly.

MS support analysed the memory dump from the crashed IIS process, observed that it was littered with references to UNC file paths on \contentserver\webmedia, and advised us to reboot the media server... we did this yesterday morning and so far, everything's running normally. We've investigating a potential problem with the firewall appliance that sits between the web servers and content server, but if you're experiencing something similar and your website's got virtual directories mapped to UNC shares, try restarting the servers on the other end of the UNC shares.