Comment 17 for bug 448084

I have investigated this a bit. Based on stack traces the crash happens here:

void
gtk_widget_show (GtkWidget *widget)
{
  g_return_if_fail (GTK_IS_WIDGET (widget)); <==== line 3005

I'm assuming that the signal for this is attached here in gnome-panel/panel-toplevel.c (line 2740):

signals [i++] = g_signal_connect_swapped (
           toplevel->priv->attach_widget, "show",
           G_CALLBACK (gtk_widget_show), toplevel);

And before the "show" signal is emitted, panel_applet_destroy() is called from gnome-panel/applet.c. I'm guessing there's a race condition which makes it possible to destroy PanelToplevel object and after that send a show signal to the destroyed object.

I haven't been able to reproduce the problem myself, all tips how to do it would help.