> As for scan_words, I don't know of such a bug.  Also looking at the code,
 > I don't see it (not that it proves anything, of course).  Could you tell me
 > where's the problem in scan_words?

With Emacs -Q define foo as

(defun foo ()
   (interactive)
   (put-text-property (1- (point)) (point) 'syntax-table '(2))
   (setq parse-sexp-lookup-properties t))

open a text-mode buffer, insert a couple of non-word chars in the
buffer, leave point after them, and type M-x foo followed by M-b.  It
goes back by _two_ characters instead of one.  The attached patch was
supposed to fix this and the other problem.