soffice.bin crashed with SIGSEGV in UpdateNativeMenu()

[Nicolas Guichard]

After finishing editing a formula in LibreOffice Writer, I quit the formula editor (Escape, clicking in the text above…) and LibreOffice always crashes.
I'm using Ubuntu 12.10 beta1 with LibreOffice 1:3.6.1~rc2-1ubuntu3.

ProblemType: Crash
DistroRelease: Ubuntu 12.10
Package: libreoffice-core 1:3.6.1~rc2-1ubuntu3
ProcVersionSignature: Ubuntu 3.5.0-14.16-generic 3.5.3
Uname: Linux 3.5.0-14-generic i686
ApportVersion: 2.5.1-0ubuntu7
Architecture: i386
CrashCounter: 1
Date: Tue Sep 11 22:13:38 2012
Disassembly: => 0x8353f631: Cannot access memory at address 0x8353f631
ExecutablePath: /usr/lib/libreoffice/program/soffice.bin
ProcCmdline: /usr/lib/libreoffice/program/soffice.bin --writer --splash-pipe=6
SegvAnalysis:
 Segfault happened at: 0x8353f631: Cannot access memory at address 0x8353f631
 PC (0x8353f631) not located in a known VMA region (needed executable region)!
SegvReason: executing unknown VMA
Signal: 11
SourcePackage: libreoffice
StacktraceTop:
 ?? ()
 UpdateNativeMenu (pMenu=pMenu@entry=0x97b9460) at /build/buildd/libreoffice-3.6.1~rc2/vcl/unx/gtk/window/gtksalmenu.cxx:103
 GenerateMenu (user_data=0x97b9460) at /build/buildd/libreoffice-3.6.1~rc2/vcl/unx/gtk/window/gtksalmenu.cxx:131
 ?? () from /lib/i386-linux-gnu/libglib-2.0.so.0
 g_main_context_dispatch () from /lib/i386-linux-gnu/libglib-2.0.so.0
Title: soffice.bin crashed with SIGSEGV in UpdateNativeMenu()
UpgradeStatus: Upgraded to quantal on 2012-07-30 (43 days ago)
UserGroups: adm cdrom dip epoptes lpadmin plugdev sambashare sudo

[Apport retracing service (apport)]

StacktraceTop:
 ?? ()
 UpdateNativeMenu (pMenu=pMenu@entry=0x97b9460) at /build/buildd/libreoffice-3.6.1~rc2/vcl/unx/gtk/window/gtksalmenu.cxx:103
 GenerateMenu (user_data=user_data@entry=0x97b9460) at /build/buildd/libreoffice-3.6.1~rc2/vcl/unx/gtk/window/gtksalmenu.cxx:131
 g_timeout_dispatch (source=source@entry=0x96e85f0, callback=0xb3716d07 <GenerateMenu(void*)>, user_data=0x97b9460) at /build/buildd/glib2.0-2.33.12/./glib/gmain.c:4026
 g_main_dispatch (context=0x857adc8) at /build/buildd/glib2.0-2.33.12/./glib/gmain.c:2715