> So I can force my shell through that same branch by hitting ^o in a
> directory containing exactly one file, but I still don't get a crash.
> 
> What does "ls" show just before you begin completing?

It's independent of that, it also works in an empty directory as I've 
just checked.

Note that in order to reproduce the issue it really seems to be 
necessary to have the 4 lines

autoload -Uz compinit
compinit
zmodload -i zsh/complist
bindkey '^o' menu-select

in your .zshrc. Just typing them or sourcing a file containing them will 
not lead to the crash in my case, even without the "-f" option. Instead 
I get a browsable list of all the files in the directory as it is 
supposed to be.