have a fairly reliable segfault.  My setup, vmware system with 2 nics running linux.  Freeswitch is snapshot from Dec 23, 2006.  I added patches as documented in http://pastebin.ca/291377 however these do not appear to be where its breaking, I just mention it for completeness.

nic 1 goes to the internet, nic 2 goes to a private network with a deskphone directly connected to the box.  

In sofia.conf I have 2 profiles, internal and external.  They bind to one IP only.  external does stun, as the internet interface is NATted.  

If I place a call from the deskphone -> freeswitch -> asterisk box (across the net) the deskphone is on the internal profile, and nic2, asterisk is on the external profile and nic1.  I use a javascript app that does a new session then bridge.

If the remote party hangs up, it segfaults, I did have a couple times when it didnt, but generally it does.

gdb backtrace (cut/paste isnt working I type this by hand)
...
Core was generated by 'bin'freeswitch'.
Program terminated with signal 11, SEgmentation fault.
#0  switch_channel_perform_hangup (channel-0x64632f72, file=0xb6635ee7 "mod_spidermonkey.c",
    func=0xb663673c "session_destroy", line=1868, hangup_cause=SWITCH_CAUSE_NORMAL_CLEARING) at src/switch_channel.c:971
         switch_mutex_lock(channel->flag_mutex)
(gdb) bt
#0  switch_channel_perform_hangup (channel-0x64632f72, file=0xb6635ee7 "mod_spidermonkey.c",
    func=0xb663673c "session_destroy", line=1868, hangup_cause=SWITCH_CAUSE_NORMAL_CLEARING) at src/switch_channel.c:971
#1  0xb663477b in new_js_event () from /usr/local/freeswitch/mod/mod_spidermonkey.so
#2  0xb629daa8 in js_FinalizeObject () from /usr/local/freeswitch/lib/libjs.so.1
#3  0xb627c6ce in js_GC () from /usr/local/freeswitch/lib/libjs.so.1
...

looking at src/switch_channel.c my additions come after where it claims its segfaulting.  I think its related to having 2 different profiles and nics, but cant say for sure.