Tried direct and indirect nfs mounts, and the test suite also does nfs and cifs mounts, no segfault:

root@server:~# automount -d3 -f 
Starting automounter version 5.1.9, master map /etc/auto.master
using kernel protocol version 5.05
lookup_nss_read_master: reading master file /etc/auto.master
do_init: parse(sun): init gathered global options: (null)
lookup_read_master: lookup(file): read entry /mnt
lookup_read_master: lookup(file): read entry /-
master_do_mount: mounting /mnt
lookup_nss_read_map: reading map file /etc/auto.mnt
do_init: parse(sun): init gathered global options: (null)
mounted indirect on /mnt with timeout 300, freq 75 seconds
st_ready: st_ready(): state = 0 path /mnt
master_do_mount: mounting /-
lookup_nss_read_map: reading map file /etc/auto.direct
do_init: parse(sun): init gathered global options: (null)
mounted direct on /foo with timeout 300, freq 75 seconds
do_mount_autofs_direct: mounted trigger /foo
st_ready: st_ready(): state = 0 path /-
handle_packet: type = 5
handle_packet_missing_direct: token 43, name /foo, request pid 14188
attempting to mount entry /foo
lookup_mount: lookup(file): looking up /foo
lookup_mount: lookup(file): /foo -> localhost:/storage
parse_mount: parse(sun): expanded entry: localhost:/storage
parse_mount: parse(sun): gathered options: 
parse_mount: parse(sun): dequote("localhost:/storage") -> localhost:/storage
parse_mount: parse(sun): core of entry: options=, loc=localhost:/storage
sun_mount: parse(sun): mounting root /foo, mountpoint /foo, what localhost:/storage, fstype nfs, options (null)
mount(nfs): root=/foo name=/foo what=localhost:/storage, fstype=nfs, options=(null)
mount_mount: mount(nfs): calling mkdir_path /foo
mount_mount: mount(nfs): /foo is local, attempt bind mount
mount_mount: mount(bind): calling mkdir_path /foo
mount(bind): calling mount --bind -o defaults /storage /foo
mount(bind): mounted /storage type bind on /foo
dev_ioctl_send_ready: token = 43
mounted /foo
handle_packet: type = 3
handle_packet_missing_indirect: token 44, name nfs, request pid 14191
attempting to mount entry /mnt/nfs
lookup_mount: lookup(file): looking up nfs
lookup_mount: lookup(file): nfs -> localhost:/storage
parse_mount: parse(sun): expanded entry: localhost:/storage
parse_mount: parse(sun): gathered options: 
parse_mount: parse(sun): dequote("localhost:/storage") -> localhost:/storage
parse_mount: parse(sun): core of entry: options=, loc=localhost:/storage
sun_mount: parse(sun): mounting root /mnt, mountpoint nfs, what localhost:/storage, fstype nfs, options (null)
mount(nfs): root=/mnt name=nfs what=localhost:/storage, fstype=nfs, options=(null)
mount_mount: mount(nfs): calling mkdir_path /mnt/nfs
mount_mount: mount(nfs): nfs is local, attempt bind mount
mount_mount: mount(bind): calling mkdir_path /mnt/nfs
mount(bind): calling mount --bind -o defaults /storage /mnt/nfs
mount(bind): mounted /storage type bind on /mnt/nfs
dev_ioctl_send_ready: token = 44
mounted /mnt/nfs


# mount -t autofs
systemd-1 on /proc/sys/fs/binfmt_misc type autofs (rw,relatime,fd=32,pgrp=1,timeout=0,minproto=5,maxproto=5,direct,pipe_ino=3020)
/etc/auto.mnt on /mnt type autofs (rw,relatime,fd=6,pgrp=14168,timeout=300,minproto=5,maxproto=5,indirect,pipe_ino=47695)
/etc/auto.direct on /foo type autofs (rw,relatime,fd=9,pgrp=14168,timeout=300,minproto=5,maxproto=5,direct,pipe_ino=47702)

It would definitely help to have a reproducer, or the core file.