I had a crash a few days ago with more or less the same Lisp and C call
stacks as msg2345. The crash was apparently triggered just by clicking
on a buffer tab.
"XEmacs 21.5 (beta33) \"horseradish\" 68f8d295be49 [Lucid]
(x86_64-unknown-linux, Mule) of Tue Jan 29 2013 on allegro