Yes, the mailbox is Maildir. I try to make a testcase for you in 24 hours. did you try to reproduce this with libefence or valgrind? $ cat ~/.gdbinit define efe set env LD_PRELOAD=libefence.so set env EF_PROTECT_FREE=1 set env EF_FILL=234 end then $ gdb mutt ... (gdb) efe (gdb) run