This is very odd; for reasons inexplicable it's repeatable only in my
(predominantly) non-debug build; it's also 100% repetable, and totally fatal.
Simply start a writer instance, Format -> Character.

The stack trace looks like this:

#6  <signal handler called>
#7  0x475fd4ac in SfxSlotServer::GetSlot() const (this=0x4aa11948) at
../inc/slotserv.hxx:114
No locals.
#8  0x475fa296 in BindDispatch_Impl (this=0x4aa11948, rDisp=@0xbfffbae0,
rURL=@0xbfffba80, pStateCache=0x0)
    at
/opt/OpenOffice/openoffice/build/RC3_030729/sfx2/source/control/statcach.cxx:127
No locals.
#9  0x47605089 in SfxBindings::QueryState(unsigned short, SfxPoolItem*&)
(this=0x4a21db88, nSlot=10933, rpState=@0xbfffbb7c)
    at
/opt/OpenOffice/openoffice/build/RC3_030729/sfx2/source/control/bindings.cxx:2639
	eState = 48
	pItem = (struct SfxPoolItem *) 0x0
	pBind = (class BindDispatch_Impl *) 0x3
	xTunnel = {<BaseReference> = {_pInterface = 0x0}, <No data fields>}
	pDisp = (struct SfxOfficeDispatch *) 0x0
	pSlot = (const SfxSlot *) 0x0
	aURL = {Complete = {pData = 0x4aa08d30}, Main = {pData = 0x4aa10320}, Protocol
= {pData = 0x4aa08c30}, User = {pData = 0x409e5220}, Password = {
    pData = 0x409e5220}, Server = {pData = 0x409e5220}, Port = 0, Path = {pData
= 0x4aa08c50}, Name = {pData = 0x409e5220}, Arguments = {
    pData = 0x409e5220}, Mark = {pData = 0x409e5220}}
	xTrans = {<BaseReference> = {_pInterface = 0x4aa0b000}, <No data fields>}
	xDisp = {<BaseReference> = {_pInterface = 0x4aa0d92c}, <No data fields>}
	pCache = (SfxStateCache *) 0x0
	pItem = (const struct SfxPoolItem *) 0x4026d316
	eState = 48
#10 0x46c74d70 in SvxCharNamePage::Initialize() (this=0x4a9713a8) at
/opt/OpenOffice/openoffice/build/RC3_030729/svx/source/dialog/chardlg.cxx:816
	pDummy = (struct SfxPoolItem *) 0x46904494
	pFrame = (struct SfxViewFrame *) 0x4a21db40
	pDocSh = (struct SfxObjectShell *) 0x4a1f96f8
	pColorTable = (struct XColorTable *) 0x4a20e570
	bKillTable = 0
	pItem = (const struct SfxPoolItem *) 0x4a20f860
	i = 1243732800
	aLink = {pInst = 0x0, pFunc = 0x812af40}
#11 0x46c73b5e in SvxCharNamePage (this=0x4a9713a8, pParent=0x4a96f6ec,
rInSet=@0xbfffbff0)
    at /opt/OpenOffice/openoffice/build/RC3_030729/svx/source/dialog/chardlg.cxx:742
No locals.
#12 0x46c781e7 in SvxCharNamePage::Create(Window*, SfxItemSet const&)
(pParent=0x4a96f6ec, rSet=@0xbfffbff0)
    at
/opt/OpenOffice/openoffice/build/RC3_030729/svx/source/dialog/chardlg.cxx:1696
No locals.
#13 0x476aa57c in SfxTabDialog::ActivatePageHdl(TabControl*) () from
/usr/lib/ooo-1.1/program/libsfx645li.so
#14 0x476a977f in SfxTabDialog::Start_Impl() () from
/usr/lib/ooo-1.1/program/libsfx645li.so
#15 0x476a92ee in SfxTabDialog::Execute() () from
/usr/lib/ooo-1.1/program/libsfx645li.so
#16 0x49fc11ee in CreateObjSwGlobalDocShellDll () from
/usr/lib/ooo-1.1/program/libsw645li.so
#17 0x49fba666 in CreateObjSwGlobalDocShellDll () from
/usr/lib/ooo-1.1/program/libsw645li.so
#18 0x475f024b in SfxDispatcher::Call_Impl(SfxShell&, SfxSlot const&,
SfxRequest&, unsigned char) () from /usr/lib/ooo-1.1/program/libsfx645li.so
#19 0x475f2add in SfxDispatcher::PostMsgHandler(SfxRequest*) () from
/usr/lib/ooo-1.1/program/libsfx645li.so
#20 0x475f29f0 in SfxDispatcher::LinkStubPostMsgHandler(void*, void*) () from
/usr/lib/ooo-1.1/program/libsfx645li.so
#21 0x4761789f in SfxHintPoster::Event(SfxHint*) () from
/usr/lib/ooo-1.1/program/libsfx645li.so
#22 0x47617851 in SfxHintPoster::LinkStubDoEvent_Impl(void*, void*) () from
/usr/lib/ooo-1.1/program/libsfx645li.so
#23 0x4022cdfa in ImplHandleClose(Window*) () from
/usr/lib/ooo-1.1/program/libvcl645li.so
#24 0x4022d5e5 in ImplWindowFrameProc(void*, SalFrame*, unsigned short, void
const*) () from /usr/lib/ooo-1.1/program/libvcl645li.so
#25 0x4028d87b in SalFrameData::HandleClientMessage(XClientMessageEvent*) ()
from /usr/lib/ooo-1.1/program/libvcl645li.so
#26 0x4028e2c4 in SalFrameData::Dispatch(_XEvent*) () from
/usr/lib/ooo-1.1/program/libvcl645li.so
#27 0x402ba9ad in SalDisplay::Dispatch(_XEvent*) () from
/usr/lib/ooo-1.1/program/libvcl645li.so
#28 0x402ba6fc in SalDisplay::Yield(unsigned char) () from
/usr/lib/ooo-1.1/program/libvcl645li.so
#29 0x402b65fb in SalDisplay::~SalDisplay() () from
/usr/lib/ooo-1.1/program/libvcl645li.so
#30 0x402b5014 in SalXLib::Yield(unsigned char) () from
/usr/lib/ooo-1.1/program/libvcl645li.so
#31 0x402bdfc8 in SalInstance::Yield(unsigned char) () from
/usr/lib/ooo-1.1/program/libvcl645li.so
#32 0x400e80a1 in Application::Yield() () from
/usr/lib/ooo-1.1/program/libvcl645li.so
#33 0x400e7fb3 in Application::Execute() () from
/usr/lib/ooo-1.1/program/libvcl645li.so
#34 0x080651c4 in desktop::Desktop::Main() ()
#35 0x400ece6f in SVMain() () from /usr/lib/ooo-1.1/program/libvcl645li.so
#36 0x402b39e0 in main () from /usr/lib/ooo-1.1/program/libvcl645li.so
#37 0x420156a4 in __libc_start_main () from /lib/tls/libc.so.6

From the code it's obvious that BindDispatch_Impl must never be called with a
NULL SfxStateCache pointer since it derefenrences it in the chained construction.

Quite how this has never been seen is not clear to me; perhaps Bindings'
Execute_Impl usually gets called before QueryState (somehow) and ensures the
cache is correctly initialized (I have no idea).

A workaround patch for the crash appears to be to create a local SfxStateCache(
nSlotId ), almost certainly not the right fix.