Reported to me by Benjamin R. Haskell via a local community Slack:

  functions+=( $'a\000\nb' 'echo crazy chars' )

Run that twice.

Zsh 5.3.1 on macOS crashes, stack-trace:

(lldb) bt
* thread #1: tid = 0x0000, 0x0000000105ace0a0 parameter.so`___lldb_unnamed_symbol64$$parameter.so + 56, stop reason = signal SIGSTOP
  * frame #0: 0x0000000105ace0a0 parameter.so`___lldb_unnamed_symbol64$$parameter.so + 56
    frame #1: 0x00000001059ce4ce zsh`arrhashsetfn + 462
    frame #2: 0x00000001059ceb75 zsh`assignaparam + 948
    frame #3: 0x000000010599ccdd zsh`___lldb_unnamed_symbol25$$zsh + 830
    frame #4: 0x000000010599ef22 zsh`___lldb_unnamed_symbol36$$zsh + 4233
    frame #5: 0x000000010599daf8 zsh`___lldb_unnamed_symbol34$$zsh + 341
    frame #6: 0x0000000105999365 zsh`___lldb_unnamed_symbol19$$zsh + 637
    frame #7: 0x0000000105998b86 zsh`execlist + 1386
    frame #8: 0x00000001059985fa zsh`execode + 196
    frame #9: 0x00000001059b1f59 zsh`loop + 800
    frame #10: 0x00000001059b4c9a zsh`zsh_main + 1434
    frame #11: 0x00007fffab7b5255 libdyld.dylib`start + 1
    frame #12: 0x00007fffab7b5255 libdyld.dylib`start + 1

Then I checked to see if I could reproduce with something simpler as the
key:

  % functions+=( a 'echo woot' )
  % functions+=( a 'echo woot' )
zsh(2741,0x7fffb46023c0) malloc: *** error for object 0x6000000000000000: pointer being freed was not allocated
*** set a breakpoint in malloc_error_break to debug
zsh: abort (core dumped)  zsh

(lldb) bt
* thread #1: tid = 0x0000, 0x00007fffab8e3dd6 libsystem_kernel.dylib`__pthread_kill + 10, stop reason = signal SIGSTOP
  * frame #0: 0x00007fffab8e3dd6 libsystem_kernel.dylib`__pthread_kill + 10
    frame #1: 0x00007fffab9cf787 libsystem_pthread.dylib`pthread_kill + 90
    frame #2: 0x00007fffab849420 libsystem_c.dylib`abort + 129
    frame #3: 0x00007fffab93903f libsystem_malloc.dylib`free + 530
    frame #4: 0x000000010a87bbab zsh`deletehashtable + 26
    frame #5: 0x000000010a89b4ae zsh`deleteparamtable + 27
    frame #6: 0x000000010a9a0110 parameter.so`___lldb_unnamed_symbol64$$parameter.so + 168
    frame #7: 0x000000010a8a04ce zsh`arrhashsetfn + 462
    frame #8: 0x000000010a8a0b75 zsh`assignaparam + 948
    frame #9: 0x000000010a86ecdd zsh`___lldb_unnamed_symbol25$$zsh + 830
    frame #10: 0x000000010a870f22 zsh`___lldb_unnamed_symbol36$$zsh + 4233
    frame #11: 0x000000010a86faf8 zsh`___lldb_unnamed_symbol34$$zsh + 341
    frame #12: 0x000000010a86b365 zsh`___lldb_unnamed_symbol19$$zsh + 637
    frame #13: 0x000000010a86ab86 zsh`execlist + 1386
    frame #14: 0x000000010a86a5fa zsh`execode + 196
    frame #15: 0x000000010a883f59 zsh`loop + 800
    frame #16: 0x000000010a886c9a zsh`zsh_main + 1434
    frame #17: 0x00007fffab7b5255 libdyld.dylib`start + 1
    frame #18: 0x00007fffab7b5255 libdyld.dylib`start + 1