I can't reproduce this one reliably, since it seems to depend on the files present in the system. Please let me know what other information you may need for this one.
dualbus@afl-bash-history-fncm:~$ md5sum output/8/crashes/id:000000,sig:11,src:001386+007877,op:splice,rep:8 415cbe0afff4b13b3134c78e0a750557 output/8/crashes/id:000000,sig:11,src:001386+007877,op:splice,rep:8 dualbus@afl-bash-history-fncm:~$ base64 output/8/crashes/id:000000,sig:11,src:001386+007877,op:splice,rep:8 MjIbMvqbfGJkf2jZAxtkUVFRUf38AJYEG/oAAPoCG1MkKHkO/yLgFBAbGxsoAKEUJHt7e3t73i76 lgEbe3t7e3veLvqWARsbGynoA1T/ARsZEAR7e3t7e3t7EJb8AHkO/yLgDBQQGxsbKAChAQCampqa mpY8gBR/GxsZVPbe17hTJC2WAAAAIFMT+hob3i8Alf2WEBsbG/9///8ke3t7aXveLxQAAP//GyoA ofECf//yG5AhJPowA1T/GxtvABsCG1MkKHkb/xr6QBSUAAQCG2QAG1QAQAAUl+2WEBsbGwrqdwAR +nx8PYB/aNkDG2RRUVFR/fwAlgQbAhtdGxsfAIAUAACiEPwAlgQbAv1TGxUbABsbGVT//3//lgTe lhR7+iADVP8bG1MkCnkb/xoMFJQABHv/e3t7+gwUlAAEe3t7e7/eERSWFBsbGyoAoRQCgAA2Gxs4 Gx8bGwT/7QU= dualbus@afl-bash-history-fncm:~$ cat env PATH= VISUAL=: EDITOR=: bind -r "\C-x\C-e" bind -q edit-and-execute-command Core was generated by `/bash/bash -rc read -e'. Program terminated with signal SIGSEGV, Segmentation fault. #0 strlen () at ../sysdeps/x86_64/strlen.S:106 106 ../sysdeps/x86_64/strlen.S: No such file or directory. (gdb) bt #0 strlen () at ../sysdeps/x86_64/strlen.S:106 #1 0x00000000004a62b8 in skip_to_delim (string=0x234af96 "$(y\226\"\374\377\372${{{{{\340.\241/\375\226${{{i{\377\336/", start=143, delims=0x7fff20689bba ")", flags=257) at subst.c:1842 #2 0x000000000050caa7 in bash_directory_completion_hook (dirname=<optimized out>) at bashline.c:3250 #3 0x00000000005b1f66 in rl_filename_completion_function (text=<optimized out>, state=<optimized out>) at complete.c:2506 #4 0x00000000005b5297 in rl_completion_matches ( text=0x234ab08 "S{{{{{{\350\377y\226\"T\374\377\226{.{bash{_{history,logout},rc},cache,lesshst,profile,ssh,viminfo},env,input,malloc,output,parallel-afl.sh}{{{{\372.\226\336\062\062|bh\372QQQQ\233\331\375$(y\226\"\374\377\372${{{{{\340.\241/\375\226${{{i{\377\336/\377", <incomplete sequence \336>, entry_function=0x5b1bc0 <rl_filename_completion_function>) at complete.c:2183 #5 0x00000000005b3527 in gen_completion_matches (text=<optimized out>, start=<optimized out>, end=<optimized out>, our_func=<optimized out>, found_quote=<optimized out>, quote_char=<optimized out>) at complete.c:1226 #6 0x00000000005addbc in rl_complete_internal (what_to_do=42) at complete.c:2019 #7 0x000000000059e637 in _rl_dispatch_subseq (key=<optimized out>, map=0x84aa00 <emacs_meta_keymap>, got_subseq=0) at readline.c:851 #8 0x000000000059ed3b in _rl_dispatch_subseq (key=<optimized out>, map=<optimized out>, got_subseq=0) at readline.c:985 #9 0x000000000059d694 in _rl_dispatch (key=37007397, map=0x8f) at readline.c:797 #10 readline_internal_char () at readline.c:629 #11 0x000000000059c5a0 in readline_internal_charloop () at readline.c:656 #12 readline_internal () at readline.c:670 #13 readline (prompt=<optimized out>) at readline.c:374 #14 0x00000000005458b3 in edit_line (p=<optimized out>, itext=<optimized out>) at ./read.def:1070 #15 read_builtin (list=<optimized out>) at ./read.def:550 #16 0x000000000046bcad in execute_builtin (builtin=0x5440f0 <read_builtin>, words=0x22ec8a8, flags=<optimized out>, subshell=0) at execute_cmd.c:4605 #17 0x00000000004624d9 in execute_builtin_or_function (words=0x22ec8a8, builtin=0x5440f0 <read_builtin>, var=0x0, redirects=0x0, fds_to_close=<optimized out>, flags=<optimized out>) at execute_cmd.c:5103 #18 execute_simple_command (simple_command=<optimized out>, pipe_in=-1, pipe_out=-1, async=<optimized out>, fds_to_close=<optimized out>) at execute_cmd.c:4391 #19 execute_command_internal (command=<optimized out>, asynchronous=<optimized out>, pipe_in=<optimized out>, pipe_out=<optimized out>, fds_to_close=<optimized out>) at execute_cmd.c:812 #20 0x00000000005348bd in parse_and_execute (string=<optimized out>, from_file=<optimized out>, flags=<optimized out>) at evalstring.c:430 #21 0x0000000000429c84 in run_one_command (command=<optimized out>) at shell.c:1405 #22 0x0000000000427e28 in main (argc=<optimized out>, argv=<optimized out>, env=<optimized out>) at shell.c:718 (gdb) frame 2 #2 0x000000000050caa7 in bash_directory_completion_hook (dirname=<optimized out>) at bashline.c:3250 3250 p = skip_to_delim (t, t - local_dirname + 1, delims, SD_NOJMP|SD_COMPLETE); (gdb) l 3245 { 3246 int p; 3247 char delims[2]; 3248 3249 delims[0] = closer; delims[1] = 0; 3250 p = skip_to_delim (t, t - local_dirname + 1, delims, SD_NOJMP|SD_COMPLETE); 3251 if (t[p] != closer) 3252 should_expand_dirname = 0; 3253 } 3254 } (gdb) p t $1 = 0x234af96 "$(y\226\"\374\377\372${{{{{\340.\241/\375\226${{{i{\377\336/" (gdb) p local_dirname $2 = 0x234af08 "S{{{{{{\350\377y\226\"T\374\377\226{.{bash{_{history,logout},rc},cache,lesshst,profile,ssh,viminfo},env,input,malloc,output,parallel-afl.sh}{{{{\372.\226\336\062\062|bh\372QQQQ\233\331\375$(y\226\"\374\377\372${{{{{\340.\241/\375\226${{{i{\377\336/"