bad bug

I have stumbled on a very bad bug in the latest hgmaster version of XBoard.
And so far I have not been able to figure out what causes the problem.
(I did not try older versions to see if they have it too, but nothing I did 
recently
seems obviouslyrelated to the problem.)

The problem is that XBoard crashes when playing an engine on an ICS (zippy 
mode).
What I do is this:

xboard -zp -ics -icshost 80.100.28.169

(This is my own ICS; in fact I have to use the IP addres on my internal LAN,
but from the outside this would connect to it.) XBoard then starts up with the
Engine-Output window open, because it had it open when I quit the previous 
session.
For the same reason, it uses -size 49.
I then log on to the ICS as a guest, with name ttt. (I suppose any name 
would do.)
Next I close the Engine-Output window by clicking on its X.
Then I start a game against the Fairy-Max bot that is alreay presenton the ICS:

match fairymax 1 0 spartan

This starts a game of Spartan Chess between the fairymax on the laptop where
I run XBoard, and the one on the ICS. During that game, the XBoard on my laptop
always crashes. It might take a couple of dozen moves, but I have never seen a
game run all the way to the end.

I have the distinct impression that with the Engine-Output window left 
open, the
crashes become much rarer (games often do complete), but they can happen.
I am not sure the fact that it is Spartan Chess has makes it really worse. 
(It could
be that Spartan games on average just last more moves than other variants.)
I did see one crash as well when I tried knightmate.

When I run with option -debug, and look in the xboard.debug file, the crashes
always happen after the local engine sent Thinking Output. It is not always the
same error, though: some times it is a simple segfault, which doesn't tell 
me much.
Sometimes it is an error in free(), which gives an elaborate stack dump. 
The backtrace
it prints in that case shows that usually the error then happens in XtFree, 
called
indirectly from XawReplace. So deep in X. By putting in printfs I could 
establish that
the XawReplace is called from InsertIntoMemo. (xengineoutput.c) Sometimes the
crash happens in DoClearMemo, but then it is usually a simple segfault, 
although
I sometimes do see backtraces that reach XtFree through XtSetValues there.

I am at a loss as to what causes this,and have no idea how to proceed further.
Weird thing it that it is always the XBoard on my laptop that crashes, 
while the
Fairy-Max bot on the ICS is playing through practically the same XBoard 
version.
(But on the ICS machine, which is running Ubuntu 9.04 rather than 10.04.)

Could everyone try if they have the same problem?