Are those who can reproduce this segfault using a reverse proxy to an SSL backend (i.e. SSLProxyEngine on)? That case is certainly one trigger for the problem: mod_proxy does not call ap_flush_conn so the EOC bucket is never sent. (there may still be other triggers)
joe
