Another occurrence with somewhat different stacks:

121125  7:05:01 [Note] /data/ssd/qa/Percona-Server-5.5.28-rel29.1-351.Linux.x86_64/bin/mysqld: ready for connections.
Version: '5.5.28-rel29.1-log'  socket: '/data/ssd/qa/94/current1_1/tmp/master.sock'  port: 13000  Percona Server with XtraDB (GPL), Release rel29.1, Revision 351
==11657== Thread 16:
==11657== Invalid read of size 8
==11657==    at 0x87E0C6: buf_flush_batch (buf0flu.c:1770)
==11657==    by 0x87E3FF: buf_flush_list (buf0flu.c:2047)
==11657==    by 0x823CC1: srv_master_thread (srv0srv.c:3692)
==11657==    by 0x38E260677C: start_thread (pthread_create.c:301)
==11657==    by 0x38E16D3C1C: clone (in /lib64/libc-2.5.so)
==11657==  Address 0x152e01a8 is 56 bytes inside a block of size 152 free'd
==11657==    at 0x4A072BA: free (vg_replace_malloc.c:446)
==11657==    by 0x87446A: buf_page_get_gen (buf0buf.ic:886)
==11657==    by 0x85ABD1: btr_free_externally_stored_field (btr0cur.c:4981)
==11657==    by 0x863723: btr_cur_pessimistic_delete (btr0cur.c:5078)
==11657==    by 0x926276: row_undo_ins (row0uins.c:117)
==11657==    by 0x91EC13: row_undo_step (row0undo.c:320)
==11657==    by 0x913049: que_run_threads (que0que.c:1257)
==11657==    by 0x839CB8: trx_general_rollback_for_mysql (trx0roll.c:97)
==11657==    by 0x8077F0: row_mysql_handle_errors (row0mysql.c:593)
==11657==    by 0x80892B: row_insert_for_mysql (row0mysql.c:1264)
==11657==    by 0x7EFA89: ha_innobase::write_row(unsigned char*) (ha_innodb.cc:6006)
==11657==    by 0x69B7E1: handler::ha_write_row(unsigned char*) (handler.cc:5359)
==11657==    by 0x5673D0: write_record(THD*, TABLE*, st_copy_info*) (sql_insert.cc:1788)
==11657==    by 0x56E463: mysql_insert(THD*, TABLE_LIST*, List<Item>&, List<List<Item> >&, List<Item>&, List<Item>&, enum_duplicates, bool) (sql_insert.cc:956)
==11657==    by 0x57EE0B: mysql_execute_command(THD*) (sql_parse.cc:3065)
==11657==    by 0x583112: mysql_parse(THD*, char*, unsigned int, Parser_state*) (sql_parse.cc:5811)
==11657==
==11657== Invalid read of size 1
==11657==    at 0x87D8FB: buf_flush_page_and_try_neighbors (buf0buf.ic:77)
==11657==    by 0x87E008: buf_flush_batch (buf0flu.c:1738)
==11657==    by 0x87E3FF: buf_flush_list (buf0flu.c:2047)
==11657==    by 0x823CC1: srv_master_thread (srv0srv.c:3692)
==11657==    by 0x38E260677C: start_thread (pthread_create.c:301)
==11657==    by 0x38E16D3C1C: clone (in /lib64/libc-2.5.so)
==11657==  Address 0x152e017b is 11 bytes inside a block of size 152 free'd
==11657==    at 0x4A072BA: free (vg_replace_malloc.c:446)
==11657==    by 0x87446A: buf_page_get_gen (buf0buf.ic:886)
==11657==    by 0x85ABD1: btr_free_externally_stored_field (btr0cur.c:4981)
==11657==    by 0x863723: btr_cur_pessimistic_delete (btr0cur.c:5078)
==11657==    by 0x926276: row_undo_ins (row0uins.c:117)
==11657==    by 0x91EC13: row_undo_step (row0undo.c:320)
==11657==    by 0x913049: que_run_threads (que0que.c:1257)
==11657==    by 0x839CB8: trx_general_rollback_for_mysql (trx0roll.c:97)
==11657==    by 0x8077F0: row_mysql_handle_errors (row0mysql.c:593)
==11657==    by 0x80892B: row_insert_for_mysql (row0mysql.c:1264)
==11657==    by 0x7EFA89: ha_innobase::write_row(unsigned char*) (ha_innodb.cc:6006)
==11657==    by 0x69B7E1: handler::ha_write_row(unsigned char*) (handler.cc:5359)
==11657==    by 0x5673D0: write_record(THD*, TABLE*, st_copy_info*) (sql_insert.cc:1788)
==11657==    by 0x56E463: mysql_insert(THD*, TABLE_LIST*, List<Item>&, List<List<Item> >&, List<Item>&, List<Item>&, enum_duplicates, bool) (sql_insert.cc:956)
==11657==    by 0x57EE0B: mysql_execute_command(THD*) (sql_parse.cc:3065)
==11657==    by 0x583112: mysql_parse(THD*, char*, unsigned int, Parser_state*) (sql_parse.cc:5811)
==11657==
==11657== Invalid read of size 1
[...]
[........ numerous occurrences of Invalid read of size 1 or 4 or 8 in buf_flush_page_and_try_neighbors as above ........]
[...]
==11657==
==11657== HEAP SUMMARY:
==11657==     in use at exit: 1,560 bytes in 5 blocks
==11657==   total heap usage: 3,162,238 allocs, 3,162,233 frees, 32,397,098,285 bytes allocated
==11657==
==11657== LEAK SUMMARY:
==11657==    definitely lost: 0 bytes in 0 blocks
==11657==    indirectly lost: 0 bytes in 0 blocks
==11657==      possibly lost: 0 bytes in 0 blocks
==11657==    still reachable: 0 bytes in 0 blocks
==11657==         suppressed: 1,560 bytes in 5 blocks
==11657==
==11657== For counts of detected and suppressed errors, rerun with: -v
==11657== ERROR SUMMARY: 12 errors from 12 contexts (suppressed: 4 from 4)