check this out

it always crashes when r.pop() gives a relatively large pointer