Crash tested with ftbench (current git branch of freetype2 and ft2demos), compiled under Ubuntu amd64 with AddressSanitizer (http://code.google.com/p/address-sanitizer/).

Valgrind crashlog:

==21625== Memcheck, a memory error detector
==21625== Copyright (C) 2002-2011, and GNU GPL'd, by Julian Seward et al.
==21625== Using Valgrind-3.8.0.SVN and LibVEX; rerun with -h for copyright info
==21625== Command: ./ftbench 4866227948384084975.bin.SIGSEGV.e7d.86
==21625==
==21625== Invalid write of size 1
==21625==    at 0x50AFFC6: ps_parser_load_field_table (freetype2/src/psaux/psobjs.c:1275)
==21625==    by 0x50764D3: parse_dict (freetype2/src/type1/t1load.c:1016)
==21625==    by 0x50788C6: T1_Open_Face (freetype2/src/type1/t1load.c:2091)
==21625==    by 0x50792B7: T1_Face_Init (freetype2/src/type1/t1objs.c:339)
==21625==    by 0x505D637: open_face (freetype2/src/base/ftobjs.c:1153)
==21625==    by 0x505FDCF: FT_Open_Face (freetype2/src/base/ftobjs.c:2080)
==21625==    by 0x506105A: FT_New_Face (freetype2/src/base/ftobjs.c:1215)
==21625==    by 0x401587: get_face (ft2demos-2.4.9/src/ftbench.c:624)
==21625==    by 0x402408: main (ft2demos-2.4.9/src/ftbench.c:752)
==21625==  Address 0x2f8 is not stack'd, malloc'd or (recently) free'd
==21625==
==21625==
==21625== Process terminating with default action of signal 11 (SIGSEGV)
==21625==  Access not within mapped region at address 0x2F8
==21625==    at 0x50AFFC6: ps_parser_load_field_table (freetype2/src/psaux/psobjs.c:1275)
==21625==    by 0x50764D3: parse_dict (freetype2/src/type1/t1load.c:1016)
==21625==    by 0x50788C6: T1_Open_Face (freetype2/src/type1/t1load.c:2091)
==21625==    by 0x50792B7: T1_Face_Init (freetype2/src/type1/t1objs.c:339)
==21625==    by 0x505D637: open_face (freetype2/src/base/ftobjs.c:1153)
==21625==    by 0x505FDCF: FT_Open_Face (freetype2/src/base/ftobjs.c:2080)
==21625==    by 0x506105A: FT_New_Face (freetype2/src/base/ftobjs.c:1215)
==21625==    by 0x401587: get_face (ft2demos-2.4.9/src/ftbench.c:624)
==21625==    by 0x402408: main (ft2demos-2.4.9/src/ftbench.c:752)
==21625==  If you believe this happened as a result of a stack
==21625==  overflow in your program's main thread (unlikely but
==21625==  possible), you can try to increase the size of the
==21625==  main thread stack using the --main-stacksize= flag.
==21625==  The main thread stack size used in this run was 8388608.
==21625==
==21625== HEAP SUMMARY:
==21625==     in use at exit: 23,732 bytes in 46 blocks
==21625==   total heap usage: 48 allocs, 2 frees, 25,236 bytes allocated
==21625==
==21625== LEAK SUMMARY:
==21625==    definitely lost: 0 bytes in 0 blocks
==21625==    indirectly lost: 0 bytes in 0 blocks
==21625==      possibly lost: 0 bytes in 0 blocks
==21625==    still reachable: 23,732 bytes in 46 blocks
==21625==         suppressed: 0 bytes in 0 blocks
==21625== Rerun with --leak-check=full to see details of leaked memory
==21625==
==21625== For counts of detected and suppressed errors, rerun with: -v
==21625== ERROR SUMMARY: 1 errors from 1 contexts (suppressed: 4 from 4)