Forcing Emacs to build with libungif instead fixes the problem, so it has something to do with how Emacs uses giflib.
Here's the stack trace from the crash in case anyone has any idea. I haven't tried to analyse this in any depth myself yet.
Reproducing the error is very easy for me. All I have to do is to open any GIF file and it immediately crashes.
I can reproduce this error with the latest sync from the source repository (I'm using the GIT mirror).
#0 gif_load (f=0x116b4d8, img=0x297ab50) at image.c:7454
#1 0x00000000005bea95 in lookup_image (f=f@entry=0x116b4d8,
spec=spec@entry=43558006) at image.c:1694
#2 0x00000000005beece in Fimage_metadata (spec=43558006, frame=12338034)
at image.c:945
#3 0x00000000005504ab in Ffuncall (nargs=<optimized out>,
args=<optimized out>) at eval.c:2808
#4 0x0000000000583d4d in exec_byte_code (bytestr=43494448, vector=12582258,
maxdepth=14096928, args_template=2, nargs=47, args=0x2) at bytecode.c:919
#5 0x000000000054ff7f in funcall_lambda (fun=10238869, nargs=nargs@entry=1,
arg_vector=arg_vector@entry=0x7fffffffcd88) at eval.c:3039
#6 0x00000000005502db in Ffuncall (nargs=2, args=0x7fffffffcd80)
at eval.c:2866
#7 0x0000000000583d4d in exec_byte_code (bytestr=43494448, vector=12582258,
maxdepth=14096928, args_template=2, nargs=140737488342392, args=0x2)
at bytecode.c:919
#8 0x0000000000550017 in funcall_lambda (fun=30384189, nargs=nargs@entry=0,
arg_vector=0x7fffffffd120, arg_vector@entry=0x7fffffffcf28) at eval.c:2973
#9 0x00000000005502db in Ffuncall (nargs=1, args=0x7fffffffcf20)
at eval.c:2866
#10 0x000000000054fbb0 in eval_sub (form=form@entry=43559014) at eval.c:2147
#11 0x0000000000552be9 in internal_lisp_condition_case (var=<optimized out>,
bodyform=43559014, handlers=<optimized out>) at eval.c:1313
#12 0x0000000000584d3e in exec_byte_code (bytestr=43494448, vector=12582258,
maxdepth=14096928, args_template=2, nargs=140737488343176, args=0x8f)
at bytecode.c:1169
#13 0x0000000000550017 in funcall_lambda (fun=30464509, nargs=nargs@entry=0,
arg_vector=0x7fffffffd290, arg_vector@entry=0x7fffffffd220) at eval.c:2973
#14 0x00000000005502db in Ffuncall (nargs=1, args=0x7fffffffd218)
at eval.c:2866
#15 0x0000000000583d4d in exec_byte_code (bytestr=43494448, vector=12582258,
maxdepth=14096928, args_template=2, nargs=23, args=0x1) at bytecode.c:919
#16 0x0000000000550017 in funcall_lambda (fun=9032693, nargs=nargs@entry=2,
arg_vector=0x7fffffffd460, arg_vector@entry=0x7fffffffd3c0) at eval.c:2973
#17 0x00000000005502db in Ffuncall (nargs=3, args=0x7fffffffd3b8)
at eval.c:2866
#18 0x0000000000583d4d in exec_byte_code (bytestr=43494448, vector=12582258,
maxdepth=14096928, args_template=2, nargs=140737488343984, args=0x3)
at bytecode.c:919
#19 0x0000000000550017 in funcall_lambda (fun=9031493, nargs=nargs@entry=0,
arg_vector=0x7fffffffd5b0, arg_vector@entry=0x7fffffffd550) at eval.c:2973
#20 0x00000000005502db in Ffuncall (nargs=1, args=0x7fffffffd548)
at eval.c:2866
#21 0x0000000000583d4d in exec_byte_code (bytestr=43494448, vector=12582258,
maxdepth=14096928, args_template=2, nargs=0, args=0x1) at bytecode.c:919
#22 0x0000000000550017 in funcall_lambda (fun=9021325, nargs=nargs@entry=0,
arg_vector=0x7fffffffd8a0, arg_vector@entry=0x7fffffffd6a8) at eval.c:2973
#23 0x00000000005502db in Ffuncall (nargs=1, args=0x7fffffffd6a0)
at eval.c:2866
#24 0x000000000054fbb0 in eval_sub (form=form@entry=43560838) at eval.c:2147
#25 0x0000000000552be9 in internal_lisp_condition_case (var=<optimized out>,
bodyform=43560838, handlers=<optimized out>) at eval.c:1313
#26 0x0000000000584d3e in exec_byte_code (bytestr=43494448, vector=12582258,
maxdepth=14096928, args_template=2, nargs=140737488345104, args=0x8f)
at bytecode.c:1169
#27 0x0000000000550017 in funcall_lambda (fun=9021085, nargs=nargs@entry=1,
arg_vector=0x7fffffffda40, arg_vector@entry=0x7fffffffd9b8) at eval.c:2973
#28 0x00000000005502db in Ffuncall (nargs=2, args=0x7fffffffd9b0)
at eval.c:2866
#29 0x0000000000583d4d in exec_byte_code (bytestr=43494448, vector=12582258,
maxdepth=14096928, args_template=2, nargs=140737488345512, args=0x2)
at bytecode.c:919
#30 0x0000000000550017 in funcall_lambda (fun=9019749, nargs=nargs@entry=2,
arg_vector=0x7fffffffdc20, arg_vector@entry=0x7fffffffdb68) at eval.c:2973
#31 0x00000000005502db in Ffuncall (nargs=3, args=0x7fffffffdb60)
at eval.c:2866
#32 0x0000000000583d4d in exec_byte_code (bytestr=43494448, vector=12582258,
maxdepth=14096928, args_template=2, nargs=140737488345944, args=0x3)
at bytecode.c:919
#33 0x0000000000550017 in funcall_lambda (fun=9017533, nargs=nargs@entry=6,
arg_vector=0x7fffffffde00, arg_vector@entry=0x7fffffffdd60) at eval.c:2973
#34 0x00000000005502db in Ffuncall (nargs=7, args=0x7fffffffdd58)
at eval.c:2866
#35 0x0000000000583d4d in exec_byte_code (bytestr=43494448, vector=12582258,
maxdepth=14096928, args_template=2, nargs=140737488346448, args=0x7)
at bytecode.c:919
#36 0x0000000000550017 in funcall_lambda (fun=9015933, nargs=nargs@entry=4,
arg_vector=0x7fffffffdf80, arg_vector@entry=0x7fffffffdf00) at eval.c:2973
#37 0x00000000005502db in Ffuncall (nargs=5, args=0x7fffffffdef8)
at eval.c:2866
#38 0x0000000000583d4d in exec_byte_code (bytestr=43494448, vector=12582258,
maxdepth=14096928, args_template=2, nargs=2, args=0x5) at bytecode.c:919
#39 0x0000000000550017 in funcall_lambda (fun=9010173, nargs=nargs@entry=2,
arg_vector=0x7fffffffe340, arg_vector@entry=0x7fffffffe068) at eval.c:2973
#40 0x00000000005502db in Ffuncall (nargs=nargs@entry=3,
args=args@entry=0x7fffffffe060) at eval.c:2866
#41 0x00000000005516cc in Fapply (nargs=nargs@entry=2,
args=args@entry=0x7fffffffe100) at eval.c:2344
#42 0x0000000000551900 in apply1 (fn=fn@entry=16448530, arg=arg@entry=43566262)
at eval.c:2578
#43 0x000000000054c4f3 in Fcall_interactively (function=16448530,
record_flag=12338034, keys=12372157) at callint.c:378
#44 0x000000000055049b in Ffuncall (nargs=<optimized out>,
args=<optimized out>) at eval.c:2812
#45 0x0000000000583d4d in exec_byte_code (bytestr=43494448, vector=12582258,
maxdepth=14096928, args_template=2, nargs=140737488347808, args=0x4)
at bytecode.c:919
#46 0x0000000000550017 in funcall_lambda (fun=9528237, nargs=nargs@entry=1,
arg_vector=0x0, arg_vector@entry=0x7fffffffe428) at eval.c:2973
#47 0x00000000005502db in Ffuncall (nargs=nargs@entry=2,
args=args@entry=0x7fffffffe420) at eval.c:2866
#48 0x00000000005505fa in call1 (fn=<optimized out>, arg1=<optimized out>)
at eval.c:2604
#49 0x00000000004eea6d in command_loop_1 () at keyboard.c:1552
#50 0x000000000054e95e in internal_condition_case (
bfun=bfun@entry=0x4ee6e0 <command_loop_1>, handlers=<optimized out>,
hfun=hfun@entry=0x4e5770 <cmd_error>) at eval.c:1344
#51 0x00000000004e0f0e in command_loop_2 (ignore=ignore@entry=12338034)
at keyboard.c:1170
#52 0x000000000054e86b in internal_catch (tag=12384578,
func=func@entry=0x4e0ef0 <command_loop_2>, arg=12338034) at eval.c:1108
#53 0x00000000004e5397 in command_loop () at keyboard.c:1149
#54 recursive_edit_1 () at keyboard.c:777
#55 0x00000000004e5682 in Frecursive_edit () at keyboard.c:841
#56 0x0000000000416c95 in main (argc=<optimized out>, argv=0x7fffffffe7c8)
at emacs.c:1637