I just found a crasher in XAP_Frame::makeBackupName (yes, it crashed for me, while it was trying to save its crashdump).
The code used to read: const char* szTmp = pSS->getValue(zzz, yyy).c_str(); What do YOU think happens here? getValue returns a temporary UT_String object, szTmp initializes to point to that string objects data and... Poof! The string object goes out of scope and gets deleted. Fun and games all day long. This is intended as a heads-up: Don't do this. /Mike
