I found this debugging a crash-on-exit running the latest code on Windows XP.
Sending bitcoind the RPC 'stop' command, I see the following "Thread exited" messages:
2013-01-22 19:35:01 ThreadRPCServer method=stop 2013-01-22 19:35:03 ThreadSocketHandler exited 2013-01-22 19:35:04 ThreadOpenConnections exited 2013-01-22 19:35:04 ThreadMessageHandler exited 2013-01-22 19:35:04 StopNode() 2013-01-22 19:35:09 Bitcoin exited
There should be a ThreadRPCServer exited message there before 'Bitcoin exited'
I'm 90% sure the crash on Windows is happening in ThreadRPCServer, decrementing vnThreadsRunning[THREAD_RPCLISTENER]. I suspect the vnThreadsRunning destructor is being called before ThreadRPCServer2 returns, because ThreadRPCServer2 is waiting inside io_service.run_one()
The entire threads/fShutdown/StartShutdown()/Shutdown() scheme is fragile and a big mess, and should be cleaned up. Not for the 0.8 release, though...