Crash tested with ftbench, compiled under Ubuntu amd64 with AddressSanitizer (http://code.google.com/p/address-sanitizer/).

Stack trace:

--- cut ---
Program received signal SIGSEGV, Segmentation fault.
0x000000000042de8d in parse_charstrings (face=0x7ffff74b4020, loader=0x7fffffffdbb0)
    at freetype2/freetype-2.4.9/src/type1/t1load.c:1742
1742          error = T1_Add_Table( swap_table, 0,
(gdb) where
#0  0x000000000042de8d in parse_charstrings (face=0x7ffff74b4020, loader=0x7fffffffdbb0)
    at freetype2/freetype-2.4.9/src/type1/t1load.c:1742
#1  0x000000000042c688 in t1_load_keyword (face=0x7ffff74b4020, loader=0x7fffffffdbb0, field=0x5c5030)
    at freetype2/freetype-2.4.9/src/type1/t1load.c:937
#2  0x000000000042e850 in parse_dict (face=0x7ffff74b4020, loader=0x7fffffffdbb0,
    base=0x7ffff74c2020 "    dup/Private 15 dict dup begin\n/RD{string currentfile exch readstring pop}executeonly def\n/ND{noaccess def}executeonly def\n/NP{noaccess put}executeonly def\n/BlueValues [-21 0 683 704 431 441 665 66"..., size=817)
    at freetype2/freetype-2.4.9/src/type1/t1load.c:1994
#3  0x000000000042ecbb in T1_Open_Face (face=0x7ffff74b4020) at freetype2/freetype-2.4.9/src/type1/t1load.c:2111
#4  0x000000000042f89e in T1_Face_Init (stream=0x7ffff747c0a0, t1face=0x7ffff74b4020, face_index=0, num_params=0, params=0x0)
    at freetype2/freetype-2.4.9/src/type1/t1objs.c:339
#5  0x000000000040b5be in open_face (driver=0x7ffff7491de0, stream=0x7ffff747c0a0, face_index=0, num_params=0, params=0x0,
    aface=0x7fffffffe040) at freetype2/freetype-2.4.9/src/base/ftobjs.c:1153
#6  0x000000000040cb8e in FT_Open_Face (library=0x7ffff749c020, args=0x7fffffffe0f0, face_index=0, aface=0x7fffffffe1c8)
    at freetype2/freetype-2.4.9/src/base/ftobjs.c:2080
#7  0x000000000040b6d2 in FT_New_Face (library=0x7ffff749c020, pathname=0x7fffffffe621 "/home/mjurczyk/tmp/font.bin",
    face_index=0, aface=0x7fffffffe1c8) at freetype2/freetype-2.4.9/src/base/ftobjs.c:1215
#8  0x0000000000407830 in get_face (face=0x7fffffffe1c8) at freetype2/ft2demos-2.4.8/src/ftbench.c:624
#9  0x0000000000407b7e in main (argc=1, argv=0x7fffffffe2f0) at freetype2/ft2demos-2.4.8/src/ftbench.c:752
(gdb) print name_table->elements
$1 = (FT_Byte **) 0x0
(gdb) print name_table->elements[0]
Cannot access memory at address 0x0
(gdb) l
1737          /* 0 333 hsbw endchar */
1738          FT_Byte  notdef_glyph[] = { 0x8B, 0xF7, 0xE1, 0x0D, 0x0E };
1739          char*    notdef_name    = (char *)".notdef";
1740
1741
1742          error = T1_Add_Table( swap_table, 0,
1743                                name_table->elements[0],
1744                                name_table->lengths [0] );
1745          if ( error )
1746            goto Fail;
--- cut ---

Sample file attached.