Hi,

I'm using the latest zsh from Debian which has the version number 
4.3.10-15, but I was able to reproduce the following behavior with the 
zsh 4.3.10 built from the official sources.

I have the line following line in my .zshrc:
> bindkey '^o' menu-select
The following sequence of keys will make zsh crash, provided that 
"gre<tab>" completes to "grep " on your system:
$ gre<tab><ctrl-o>

In /var/log/syslog I find the following lines after the crash:
> Aug 12 16:20:55 ph kernel: [228053.669743] zsh[14263]: segfault at 20 ip 00007fcba8135b92 sp 00007fff9c3402d8 error 4 in libc-2.11.2.so[7fcba80ba000+158000]
> Aug 12 16:21:01 ph /USR/SBIN/CRON[14357]: (ph) CMD (/home/ph/bin/checkoffline)
> Aug 12 16:21:01 ph /USR/SBIN/CRON[14356]: (ph) CMD (/home/ph/bin/checkmsmtp)
> Aug 12 16:21:36 ph kernel: [228094.527543] zsh[14864]: segfault at 1c ip 00007f507ce609dc sp 00007fff1b97c630 error 4 in complete.so[7f507ce4c000+23000]

I'd love to be of further assistance in tracking down what is going on 
in case the information I provided is not sufficient.

Best,
Philipp