When using a [custom] RPC client, and upon that client crashing (that is, ungracefully dropping a connection), I am somewhat consistently having bitcoind SEGV.
I'll see if I can't create a simple test case...
edit: not as consistently as I'd hoped