I'll add a comment.  This was an existing bug that one of my test cases started to hit - manifests itself as an InvalidRead in valgrind.