> The difference seems to be whether the zsh/compctl module is loaded.  I
> don't immediately know why zsh/compctl would be necessary for proper
> execution of menu-select, but if I add
> 
> zmodload zsh/compctl
> 
> to the minimal zshrc, I am no longer able to force a crash.  I tried with
> zsh 4.3.9 as well, and I can crash it if compctl is not loaded, but not
> when compctl is loaded.

I also do not experience any more crashes since adding

zmodload zsh/compctl

to my .zshrc. Unfortunately this breaks the menu-select feature in some 
cases.

For example with this .zshrc

autoload -Uz compinit
compinit
zmodload -i zsh/complist
#zmodload zsh/compctl
zstyle ':completion:*' matcher-list 'm:{a-z}={A-Z}' 'r:|[._-]=* r:|=*' 'l:|=* r:|=*'
bindkey '^o' menu-select

and a folder 

ph% ls
baz-foo  test-foo

doing

ph% vi foo<tab><tab><ctrl-o>

will work out nice and give me the desired menu-selection (or crash).  
But if I comment in the line in the .zshrc above, no menu-select will 
take place anymore.