Issue 1:
Using @cfunction on a function without a stable return type and then calling the function through the returned function pointer produces a segfault. We discussed this on discourse, where we came up with several simple cases to reproduce the issue. The simplest one seems to be:

julia> f(x) = x ? 1 : 2.0
f (generic function with 1 method)

julia> fptr = @cfunction(f, Any, (Bool,))
Ptr{Nothing} @0x00007effcbe85e00

julia> ccall(fptr, Any, (Bool,), true)
Unreachable reached at 0x7effcbe85f2a

signal (4): Illegal instruction

Issue 2:
I'm not sure if this change was expected going forward from 0.6. Previously this would have returned a function pointer to a function that threw a TypeError if the arguments produced a result that was not the same type as the returntype argument to cfunction.

Running julia-debug

julia> unstable(x) = x > 0 ? x : "foo"
unstable (generic function with 1 method)

julia> handle = cfunction(unstable, Int32, Tuple{Int32})
Ptr{Nothing} @0x000065a36dc16c10

julia> ccall(handle, Int32, (Int32,), 1)

signal (11): Segmentation fault
in expression starting at no file:0
unknown function (ip: 0x65a36dc16cd9)
top-level scope at ./<missing> (unknown line)
jl_call_fptr_internal at /buildworker/worker/package_linux64/build/src/julia_internal.h:383 [inlined]
jl_call_method_internal at /buildworker/worker/package_linux64/build/src/julia_internal.h:402 [inlined]
jl_toplevel_eval_flex at /buildworker/worker/package_linux64/build/src/toplevel.c:801
jl_toplevel_eval_in at /buildworker/worker/package_linux64/build/src/builtins.c:626
eval at ./boot.jl:298 [inlined]
eval at /buildworker/worker/package_linux64/build/usr/share/julia/site/v0.7/REPL/src/REPL.jl:3
jl_call_fptr_internal at /buildworker/worker/package_linux64/build/src/julia_internal.h:383 [inlined]
jl_call_method_internal at /buildworker/worker/package_linux64/build/src/julia_internal.h:402 [inlined]
jl_apply_generic at /buildworker/worker/package_linux64/build/src/gf.c:2089
eval_user_input at /buildworker/worker/package_linux64/build/usr/share/julia/site/v0.7/REPL/src/REPL.jl:84
jl_call_fptr_internal at /buildworker/worker/package_linux64/build/src/julia_internal.h:383 [inlined]
jl_call_method_internal at /buildworker/worker/package_linux64/build/src/julia_internal.h:402 [inlined]
jl_apply_generic at /buildworker/worker/package_linux64/build/src/gf.c:2089
macro expansion at /buildworker/worker/package_linux64/build/usr/share/julia/site/v0.7/REPL/src/REPL.jl:115 [inlined]
#29 at ./event.jl:92
jl_call_fptr_internal at /buildworker/worker/package_linux64/build/src/julia_internal.h:383 [inlined]
jl_call_method_internal at /buildworker/worker/package_linux64/build/src/julia_internal.h:402 [inlined]
jl_apply_generic at /buildworker/worker/package_linux64/build/src/gf.c:2089
jl_apply at /buildworker/worker/package_linux64/build/src/julia.h:1523 [inlined]
start_task at /buildworker/worker/package_linux64/build/src/task.c:268
unknown function (ip: 0xffffffffffffffff)
Allocations: 4042586 (Pool: 4041316; Big: 1270); GC: 8
Segmentation fault (core dumped)

In 0.6 the following was possible

julia> function unstable(x)
x > 0 ? x : "foo"
end
unstable (generic function with 1 method)

julia> handle = cfunction(unstable, Int32, Tuple{Int32})
Ptr{Void} @0x00006b1ffd6a3fa0

julia> ccall(handle, Int32, (Int32,), 1)
1

julia> ccall(handle, Int32, (Int32,), 0)
ERROR: TypeError: : in cfunction, expected Int32, got String
Stacktrace:
[1] anonymous at ./<missing>:?
[2] macro expansion at ./REPL.jl:97 [inlined]
[3] (::Base.REPL.##1#2{Base.REPL.REPLBackend})() at ./event.jl:73