Same here with midori 0.3.2 on up-to-date Ubuntu Linux (x86-64)...
I've run midori with strace (-f), it seems to crash just after writing to ~/.config/midori/speeddial.json , which is not yet synced nor closed when SIGSEGV rises...

Here is the critical part (not sure the whole log would help, but it is available if anyone is interested).
I started midori once first to reset the session to a single speed dial tab. Then I restart midori, and click one empty slot to add a shortcut, enter an URL, enter shortname, and boom.

20728 open("/home/brice/.config/midori/speeddial.json.P1YFYV", O_RDWR|O_CREAT|O_EXCL, 0666) = 21
20728 fcntl(21, F_GETFL)                = 0x8002 (flags O_RDWR|O_LARGEFILE)
20728 fstat(21, {st_mode=S_IFREG|0644, st_size=0, ...}) = 0
20728 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f0fe2ce4000
20728 lseek(21, 0, SEEK_CUR)            = 0
20728 write(21, " '{\"shortcuts\":[{\"id\":\"s1\",\"href"..., 20480) = 20480
20728 write(21, "qtdWcpPplm4ovXDLPOYGxrqI4m8hYjwU"..., 4092) = 4092
20728 fstatfs(21, {f_type="EXT2_SUPER_MAGIC", f_bsize=4096, f_blocks=5160447, f_bfree=1291182, f_bavail=1029022, f_files=2626560, f_ffree=2231992, f_fsid={-1866684618, 1339920286}, f_namelen=255, f_frsize=4096}) = 0
20728 lstat("/home/brice/.config/midori/speeddial.json", {st_mode=S_IFREG|0644, st_size=10541, ...}) = 0
20728 fsync(21 <unfinished ...>
20752 <... swapoff resumed> )           = 0
20752 clock_gettime(CLOCK_MONOTONIC, {5998560, 597723725}) = 0
20752 read(3,  <unfinished ...>
20728 <... sethostname resumed> )       = 0
20752 <... read resumed> 0x9fd8218, 4096) = -1 EAGAIN (Resource temporarily unavailable)
20728 close(21 <unfinished ...>
20752 read(3,  <unfinished ...>
20728 <... read resumed> "", 4092)      = 0
20752 <... read resumed> 0x9fd8218, 4096) = -1 EAGAIN (Resource temporarily unavailable)
20728 munmap(0x7f0fe2ce4000, 4096 <unfinished ...>
20752 poll([{fd=3, events=POLLIN}], 1, 0 <unfinished ...>
20728 <... execve resumed> )            = 0
20752 <... poll resumed> )              = 0 (Timeout)
20728 rename("/home/brice/.config/midori/speeddial.json.P1YFYV", "/home/brice/.config/midori/speeddial.json" <unfinished ...>
20752 read(4, 0x9ffc178, 4096)          = -1 EAGAIN (Resource temporarily unavailable)
20752 read(3, 0x9fd8218, 4096)          = -1 EAGAIN (Resource temporarily unavailable)
20728 <... oldselect resumed> )         = 0 (Timeout)
20752 read(3, 0x9fd8218, 4096)          = -1 EAGAIN (Resource temporarily unavailable)
20752 poll([{fd=3, events=POLLIN}], 1, 0) = 0 (Timeout)
20752 clock_gettime(CLOCK_MONOTONIC, {5998560, 598281235}) = 0
20752 poll([{fd=5, events=POLLIN}, {fd=4, events=POLLIN}, {fd=3, events=POLLIN}, {fd=8, events=POLLIN}], 4, 25 <unfinished ...>
20728 writev(11, [{"GIOP\1\2\1\0\220\v\0\0", 12}, {"\230\2524&\3\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0'4\20X\342\235\250(\300+(("..., 2044}, {"ROLE_TOOL_TIP\0\0\0\n\0\0\0ROLE_TREE\0\0\0"..., 916}], 3) = 2972
20728 poll([{fd=6, events=POLLIN}, {fd=11, events=POLLIN|POLLPRI}, {fd=12, events=POLLIN|POLLPRI}, {fd=18, events=POLLIN|POLLPRI}], 4, -1) = 1 ([{fd=11, revents=POLLIN}])
20728 read(11, "GIOP\1\2\1\1$\0\0\0", 12) = 12
20728 read(11, "\230\2524&\0\0\0\0\1\0\0\0\1\0\0\0\f\0\0\0\1\1\1\1\1\0\1\5\t\1\1\0"..., 36) = 36
20728 write(2, "\n(midori:20728): GLib-CRITICAL *"..., 103) = 103
20728 --- SIGSEGV (Segmentation fault) @ 0 (0) ---
20728 poll([{fd=3, events=POLLIN|POLLOUT}], 1, -1) = 1 ([{fd=3, revents=POLLOUT}])
20728 writev(3, [{"6\2\2\0.\t\340\16\33\6\2\0\0\0\0\0", 16}, {NULL, 0}, {"", 0}], 3) = 16
20728 read(3, 0x7f100a61c0a4, 4096)     = -1 EAGAIN (Resource temporarily unavailable)
20728 poll([{fd=3, events=POLLIN|POLLOUT}], 1, -1) = 1 ([{fd=3, revents=POLLOUT}])
20728 writev(3, [{" \2\2\0\0\0\0\0", 8}, {NULL, 0}, {"", 0}], 3) = 8
20728 read(3, 0x7f100a61c0a4, 4096)     = -1 EAGAIN (Resource temporarily unavailable)
20728 poll([{fd=3, events=POLLIN|POLLOUT}], 1, -1) = 1 ([{fd=3, revents=POLLOUT}])
20728 writev(3, [{"%\2\1\0+\0\1\0", 8}, {NULL, 0}, {"", 0}], 3) = 8
20728 poll([{fd=3, events=POLLIN}], 1, -1) = 1 ([{fd=3, revents=POLLIN}])
20728 read(3, "\1\2>.\0\0\0\0\6\0\340\16\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 4096) = 32
20728 read(3, 0x7f100a61c0a4, 4096)     = -1 EAGAIN (Resource temporarily unavailable)
20728 read(3, 0x7f100a61c0a4, 4096)     = -1 EAGAIN (Resource temporarily unavailable)
20728 open("/tmp/bug-buddy-7JKKYV", O_RDWR|O_CREAT|O_EXCL, 0600) = 21
20728 write(21, "\n\n---- Critical and fatal warnin"..., 65) = 65
20728 write(21, "** GLib **: g_hash_table_lookup_"..., 81) = 81
20728 close(21)                         = 0
20728 pipe([21, 23])                    = 0
20728 clone(child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7f10095f9c70) = 20864
20728 close(23)                         = 0
20728 read(21,  <unfinished ...>
20864 rt_sigaction(SIGPIPE, {SIG_DFL, [PIPE], SA_RESTORER|SA_RESTART, 0x7f1004460d80}, {SIG_IGN, [PIPE], SA_RESTORER|SA_RESTART, 0x7f1004460d80}, 8) = 0
20864 close(21)                         = 0
20864 open("/proc/self/fd", O_RDONLY|O_NONBLOCK|O_DIRECTORY|O_CLOEXEC) = 21
20864 getdents(21, /* 33 entries */, 32768) = 792
20864 fcntl(3, F_SETFD, FD_CLOEXEC)     = 0
20864 fcntl(4, F_SETFD, FD_CLOEXEC)     = 0
20864 fcntl(5, F_SETFD, FD_CLOEXEC)     = 0
20864 fcntl(6, F_SETFD, FD_CLOEXEC)     = 0
20864 fcntl(7, F_SETFD, FD_CLOEXEC)     = 0
20864 fcntl(8, F_SETFD, FD_CLOEXEC)     = 0
20864 fcntl(9, F_SETFD, FD_CLOEXEC)     = 0
20864 fcntl(10, F_SETFD, FD_CLOEXEC)    = 0
20864 fcntl(11, F_SETFD, FD_CLOEXEC)    = 0
20864 fcntl(12, F_SETFD, FD_CLOEXEC)    = 0
20864 fcntl(13, F_SETFD, FD_CLOEXEC)    = 0
20864 fcntl(14, F_SETFD, FD_CLOEXEC)    = 0
20864 fcntl(15, F_SETFD, FD_CLOEXEC)    = 0
20864 fcntl(16, F_SETFD, FD_CLOEXEC)    = 0
20864 fcntl(17, F_SETFD, FD_CLOEXEC)    = 0
20864 fcntl(18, F_SETFD, FD_CLOEXEC)    = 0
20864 fcntl(19, F_SETFD, FD_CLOEXEC)    = 0
20864 fcntl(20, F_SETFD, FD_CLOEXEC)    = 0
20864 fcntl(22, F_SETFD, FD_CLOEXEC)    = 0
20864 fcntl(23, F_SETFD, FD_CLOEXEC)    = 0
20864 fcntl(24, F_SETFD, FD_CLOEXEC)    = 0
20864 fcntl(25, F_SETFD, FD_CLOEXEC)    = 0
20864 fcntl(29, F_SETFD, FD_CLOEXEC)    = 0
20864 fcntl(31, F_SETFD, FD_CLOEXEC)    = 0
20864 fcntl(33, F_SETFD, FD_CLOEXEC)    = 0
20864 fcntl(36, F_SETFD, FD_CLOEXEC)    = 0
20864 fcntl(54, F_SETFD, FD_CLOEXEC)    = 0
20864 getdents(21, /* 0 entries */, 32768) = 0
20864 close(21)                         = 0
20864 open("/dev/null", O_RDONLY)       = 21
20864 dup2(21, 0)                       = 0
20864 close(21)                         = 0
20864 execve("/home/brice/bin/bug-buddy", ["bug-buddy", "--appname=midori", "--include=/tmp/bug-buddy-7JKKYV", "--unlink-tempfile", "--pid=20728"], [/* 49 vars */]) = -1 ENOENT (No such file or directory)

Afterward, most of the trace is bug-buddy's stuff (collecting info, and so on...)

The critical warning reported:

** GLib **: g_hash_table_lookup_extended: assertion `hash_table != NULL' failed

Hope this helps (I'm not very familiar with high-level code ... ^_^)