zsh 4.0.4 core dump

[Paul Lew <paullew@cisco.com>]

We have been using zsh 4.0.4 for a while and experiencing occasional
core dump for the past 6 months.  The behavior is if we left a zsh
session there overnight, the first carriage return will cause it to
core.

After build a debugged version, the gdb says:

Program terminated with signal 10, Bus Error.
#0  0x2af38 in bin_dot (name=0x0, argv=0x1, ops=0x39ce7 "", func=-4264968)
    at builtin.c:3380
3380                    if (!(*t)[0] || ((*t)[0] == '.' && !(*t)[1])) {
(gdb) where
#0  0x2af38 in bin_dot (name=0x0, argv=0x1, ops=0x39ce7 "", func=-4264968)
    at builtin.c:3380
#1  0x2ad98 in bin_dot (name=0x9e918 "", argv=0x0, ops=0xa7a90 "precmd", 
    func=0) at builtin.c:3365
#2  0x310d4 in cond_val (args=0x8, num=139192) at cond.c:396
(gdb) p t
$1 = (char **) 0x81000000
(gdb) p *t
Cannot access memory at address 0x81000000

The source around line 3380 of builtin.c looks like:

 3376      if (!*s || (ret && isset(PATHDIRS) && diddot < 2 && dotdot == 0)) {
 3377          pushheap();
 3378          /* search path for script */
 3379          for (t = path; *t; t++) {
 3380 --->         if (!(*t)[0] || ((*t)[0] == '.' && !(*t)[1])) {
 3381                  if (diddot)
 3382                      continue;
 3383                  diddot = 1;
 3384                  buf = dupstring(arg0);
 3385              } else
 3386                  buf = zhtricat(*t, "/", arg0);

Seems like our precmd triggered a bug.  Has this been reported at all?

Thanks in advance...