Crash when capturing command output in completion

[Vin Shelton <acs@alumni.princeton.edu>]

Using the latest sources, I'm getting a crash during completion with
capturing command output.

$ installed_packages

==>

apel build c-support calc cc-mode cedet-common debug dired easypg ecb
ecrypto edebug ediff edit-utils efs eieio elib emerge fsf-compat
general-docs gnus ibuffer igrep ilisp ispell mail-lib mmm-mode
net-utils os-utils pc pcl-cvs perl-modes pgg prog-modes ps-print psgml
psgml-dtds python-modes re-builder ruby-modes semantic sgml sh-script
speedbar supercite texinfo text-modes tramp vc xemacs-base
xemacs-devel

$ scm_update $(installed_<TAB>

==>

  scm_update $(installed_packages )<TAB>

==> Boom!  My terminal emulator disappeared.
==> Here is the backtrace:

gdb /opt/zsh-2015-01-15-1337/bin/zsh core
GNU gdb (Ubuntu 7.7.1-0ubuntu5~14.04.2) 7.7.1
Copyright (C) 2014 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-linux-gnu".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>.
Find the GDB manual and other documentation resources online at:
<http://www.gnu.org/software/gdb/documentation/>.
For help, type "help".
Type "apropos word" to search for commands related to "word"...
Reading symbols from /opt/zsh-2015-01-15-1337/bin/zsh...done.
[New LWP 4891]
Core was generated by `/opt/zsh-2015-01-15-1337/bin/zsh -l'.
Program terminated with signal SIGSEGV, Segmentation fault.
#0  0x00007fa93238cd40 in ?? () from /lib/x86_64-linux-gnu/libc.so.6
(gdb) bt
#0  0x00007fa93238cd40 in ?? () from /lib/x86_64-linux-gnu/libc.so.6
#1  0x00007fa930d66d6a in callcompfunc (s=0x7fa933009ff0 "installed_packages",
    fn=0x1aaaa90 "_main_complete") at compcore.c:743
#2  0x00007fa930d67ced in makecomplist (s=0x7fa933009ff0
"installed_packages", incmd=0, lst=0)
    at compcore.c:989
#3  0x00007fa930d65915 in do_completion (dummy=0x7fa9313dcb48 <zlehooks+40>,
    dat=0x7fff21af6710) at compcore.c:349
#4  0x00000000004682ac in runhookdef (h=0x7fa9313dcb48 <zlehooks+40>,
d=0x7fff21af6710)
    at module.c:996
#5  0x00007fa9311c22ed in docompletion (s=0x1af0d08
"\205installed_packages", lst=0, incmd=0)
    at zle_tricky.c:2282
#6  0x00007fa9311bda42 in docomplete (lst=0) at zle_tricky.c:866
#7  0x00007fa9311bc345 in expandorcomplete (args=0x7fa9313dd0c8 <zlenoargs>)
    at zle_tricky.c:315
#8  0x00007fa9311bbf2a in completecall (args=0x7fa9313dd0c8
<zlenoargs>) at zle_tricky.c:208
#9  0x00007fa9311a9502 in execzlefunc (func=0x7fa9313d96a0 <thingies+1920>,
    args=0x7fa9313dd0c8 <zlenoargs>, set_bindk=0) at zle_main.c:1345
#10 0x00007fa9311a86d6 in zlecore () at zle_main.c:1066
#11 0x00007fa9311a9060 in zleread (lp=0x6dbcf0 <prompt>, rp=0x0,
flags=3, context=0,
    init=0x7fa9311cf14d "zle-line-init", finish=0x7fa9311cf13d
"zle-line-finish")
    at zle_main.c:1253
#12 0x00007fa9311abb65 in zle_main_entry (cmd=1, ap=0x7fff21af6cf8) at
zle_main.c:1914
#13 0x000000000044f2a0 in zleentry (cmd=1) at init.c:1516
#14 0x0000000000450197 in inputline () at input.c:287
#15 0x000000000045000b in ingetc () at input.c:221
#16 0x0000000000443699 in ihgetc () at hist.c:361
#17 0x0000000000459b4a in gettok () at lex.c:583
#18 0x0000000000459322 in zshlex () at lex.c:264
#19 0x000000000047c78f in parse_event (endtok=37) at parse.c:538
#20 0x000000000044bd75 in loop (toplevel=1, justonce=0) at init.c:145
#21 0x000000000044f794 in zsh_main (argc=2, argv=0x7fff21af7088) at init.c:1671
#22 0x000000000040e82d in main (argc=2, argv=0x7fff21af7088) at ./main.c:93
(gdb)

I cannot reproduce this in a zsh started with "-f", so this has
something to do with my customizations.  Can anyone else reproduce
this?

Thank you,
  Vin