If you don't have 110767, then why is it interesting to report this
crash?  That revision was supposed to fix precisely this crash.

I didn't get the impression from our previous exchange that you had such a high confidence in the connection (just that you were sure it was fixing a bug, not that it was necessarily the bug I was tripping over).
 
The current revision numbers on the emacs-24 branch and on the trunk
are 110941 and 110993, respectively.  So why would you use such an old
version, from more than 3 weeks ago?

This bug took hours/days to manifest; I wanted to see whether trunk already had it fixed.  It seems that it was at least partially fixed since this time it took a lot longer to manifest.

I'll sync & rebuild and will report back if I get another one of these.