Does anyone have any ideas about this? It causes a reproducible crash
(see very nice recipe below) with the current EMACS_22_BASE on
Gnu/Linux, so it would be good to fix.

It happens because when Fwrite_region calls
Vselect_safe_coding_system_function, it opens a window for the user to
modify the buffer mid-save. The abort in buf_charpos_to_bytepos in
marker.c due to changed buffer size is what causes the actual crash.

One easy solution is to for Fwrite_region to make the buffer read-only
while Vselect_safe_coding_system_function is called. That will protect
against accidental editing of the buffer at least, but of course a
determined user could still make the buffer writable again.

Ideally, I think one would want errors during write-region to abort
the write, not Emacs.