I had a crash a few days ago with more or less the same Lisp and C call
stacks as msg2345.  The crash was apparently triggered just by clicking
on a buffer tab.

"XEmacs 21.5  (beta33) \"horseradish\" 68f8d295be49 [Lucid]
(x86_64-unknown-linux, Mule) of Tue Jan 29 2013 on allegro