Hmm, that's pretty interesting. Possibly it's just another manifestation of something scribbling past the end of its allocated chunk, but my credence for that theory is way down if there's no add-on code involved. Does the postmaster log show any messages like WARNING: detected write past chunk end in ... before the crash?
regards, tom lane
Nope. Just a bunch of messages saying "checkpoints occurring too frequently", then "server process (PID 123456) was terminated by signal 11: Segmentation fault"