#32 0x0806822a in ast_say_number_full (chan=0x80f0368, num=134642064,
    ints=0x0, language=0xffffffff <Address 0xffffffff out of bounds>,
    options=0x0, audiofd=-1, ctrlfd=0) at say.c:530
No locals.
#33 0x08067b04 in ast_say_character_str_full (chan=0x80f0388,
    fn2=0x1 <Address 0x1 out of bounds>, ints=0x4 <Address 0x4 out of bounds>,
    lang=0x80eb808 "/usr/sbin/safe_asterisk", audiofd=255, ctrlfd=135201672)
    at say.c:264
        fn = "\001\017\b\000\000\000\000\210\005\017\b\000\000\000\000\001", '\0' <repeats 15 times>, "\b\001\017\bH\003\017\b\000\000\000\000\002\017\bh\003\017\b\230&#65533;&#65533;177\006\b&#65533;003\017\b\001\000\000\000h\003\017\b", '\0'---Type <return> to continue, or q <return> to quit---
 <repeats 20 times>, "\000\000\000\000\002\017\b\000\000\000\000&#65533;X\222\006\b\002\017\b\001\000\000\000h\003\017\b{\f\b&#65533;000\000\000\000\000\000\000\210\003\017\bh\003\017\b\b&#65533;*\202\006\b\210\003\017\b\000\000\000\000h\003\017\b", '\0' <repeats 16 times>, "\220y\006\bh\003\017\bh"...
        ltr = 104 'h'
        num = -1
        res = -1
#34 0x0805cc59 in ast_read (chan=0x0) at channel.c:1324
        f = (struct ast_frame *) 0x805cc59
        blah = 255
        func = (int (*)(void *)) 0xbfffea68
        data = (void *) 0x0
        res = -512
        null_frame = {frametype = 1431634679, subclass = 8,
  datalen = 135176904, samples = 0, mallocd = 8, offset = -808464433,
  src = 0xcfcfcfcf <Address 0xcfcfcfcf out of bounds>, data = 0x14,
  delivery = {tv_sec = 1431634679, tv_usec = 16}, prev = 0x0, next = 0x80ed988}
#35 0x0805afeb in ast_queue_frame (chan=0x2, fin=0xbfffeb04) at channel.c:413
        f = (struct ast_frame *) 0xffffffff
        prev = (struct ast_frame *) 0xffffffff
        cur = (struct ast_frame *) 0xfffffe00
        blah = 0
        qlen = 0