I ran emacs under gdb, stepping through Fccl_execute_on_string.  When 
doing the "is this a utf-8 string" test on "foo", I caught it doing a 
massive character copy of millions of characters.  This happened because 
ccl.produced was a large number (around 5 million).

I then went looking for a reason for ccl.produced to be so wrong.  The 
CCL program in question has a "buffer magnification" of zero, which 
means "produce no bytes".  In this case the current destination pointer, 
dst, is set to NULL.  A NULL dst causes the calculation of ccl->produced 
just after the ccl_finish tag in ccl_driver() to be wrong, because the 
code does

ccl->produced = dst - destination

I changed this code (patch attached) so that it set ccl->produced to 
zero if dst was NULL.  With this change, both the type error and the 
segfault no longer happen.  (The type error is fixed because we're no 
longer reading random memory and treating it as encoded characters.)

Regards,

/Bob