I have yet to find a minimal example to reproduce this. I know the
following few facts. It must be run under tty and seems to related to
overlays. It was triggered by flymake in some python files. The contents
of those files are only partly displayed by Emacs (see screenshots
attached). My Emacs was built on 2012-04-28.

(gdb) 
Run till exit from #0  0x000000010003d316 in move_it_in_display_line_to (it=0x7fff5fbfb248, to_charpos=411, to_x=-1, op=12) at xdisp.c:7990
0x000000010003f702 in move_it_to (it=0x7fff5fbfb248, to_charpos=411, to_x=-1, to_y=-1, to_vpos=1, op=12) at xdisp.c:8536
8536		      skip = move_it_in_display_line_to (it, to_charpos, to_x, op);
Value returned is $2 = MOVE_POS_MATCH_OR_ZV
(gdb) 
Run till exit from #0  0x000000010003f702 in move_it_to (it=0x7fff5fbfb248, to_charpos=411, to_x=-1, to_y=-1, to_vpos=1, op=12) at xdisp.c:8536
move_it_vertically_backward (it=0x7fff5fbfce20, dy=0) at xdisp.c:8816
8816		       && SREF (it2.string, IT_STRING_BYTEPOS (it2) - 1) == '\n')));
(gdb) next
8804	      move_it_to (&it2, start_pos, -1, -1, it2.vpos + 1,
(gdb) 
8816		       && SREF (it2.string, IT_STRING_BYTEPOS (it2) - 1) == '\n')));
(gdb) 
8804	      move_it_to (&it2, start_pos, -1, -1, it2.vpos + 1,
(gdb) 
8816		       && SREF (it2.string, IT_STRING_BYTEPOS (it2) - 1) == '\n')));
(gdb) 
8804	      move_it_to (&it2, start_pos, -1, -1, it2.vpos + 1,
(gdb) 
8816		       && SREF (it2.string, IT_STRING_BYTEPOS (it2) - 1) == '\n')));
(gdb) 
8804	      move_it_to (&it2, start_pos, -1, -1, it2.vpos + 1,
(gdb) 
8816		       && SREF (it2.string, IT_STRING_BYTEPOS (it2) - 1) == '\n')));