weird execution stack corruption

[George Schlossnagle]

I'm experiencing weird Perl execution stack corruption.  If I call  
the following function:

 pTHX;
  pl = zend_object_store_get_object(getThis() TSRMLS_CC);
#ifdef USE_ITHREADS
  aTHX = pl->perl;
#endif
  {
    dSP;

    argc = ZEND_NUM_ARGS();
    args = (zval ***) safe_emalloc(sizeof(zval **), argc, 0);
    if(zend_get_parameters_array_ex(argc, args) == FAILURE) {
      efree(args);
      WRONG_PARAM_COUNT;
    }

    ENTER;
    SAVETMPS;
    PUSHMARK(SP);
    XPUSHs(sv_2mortal(newSVsv(pl->sv)));
    for(i = offset; i < argc; i++) {
      var = newSVzval(*args[i], SandwichG(php));
      var = sv_2mortal(var);
      XPUSHs(var);
    }
    PUTBACK;
    call_method(method, G_SCALAR);
    SPAGAIN;
    prv = POPs;
    /*
    if(coe && SvTRUE(ERRSV)) {
      croak(SvPVx(ERRSV, n_a));
    }
    */
    SV *newrv;
    newrv = newSVsv(prv);
fprintf(stderr, "%s:%d\n", __FILE__, __LINE__);
sv_dump(SvRV(pl->sv));
    PUTBACK;
    retval = SvZval(newrv TSRMLS_CC);
    RETURN_ZVAL(retval, 1, 0);  // does not actually return
    FREETMPS;
    LEAVE;
    efree(args);
  }
}


Then at the end of my script I seem to jump back and reexecute a  
number of ops, then SIGBUS in perl_run().  Valgrind doesn't throw any  
errors until this end bit happens, and then indicates simply that  
everything I'm running at that point is invalid.  If I drop the call  
to this function (but use the rest of the extension), everything runs  
fine.  If I explicitly call exit at the end of the script, then  
everything runs fine (and I get no valgrind errors).

I assume I'm doing something bad/stupid in this function, but for the  
life of me I can't see what.  Any thoughts?

Thanks in advance,

George