Comment 2 for bug 1616213

Thread 5 is on the way out:

(gdb) thread 5
[Switching to thread 5 (Thread 0x7f21ca11f840 (LWP 41582))]
#0 0x00007f21c9111dfd in nanosleep () at ../sysdeps/unix/syscall-template.S:81
81 ../sysdeps/unix/syscall-template.S: No such file or directory.
(gdb) up
#1 0x00007f21c9111c94 in __sleep (seconds=0) at ../sysdeps/unix/sysv/linux/sleep.c:137
137 ../sysdeps/unix/sysv/linux/sleep.c: No such file or directory.
(gdb)
#2 0x00000000004084e6 in child (param=0x0) at main.c:1539
1539 sleep (1); /* This is weak. */
(gdb) list
1534 free_polls();
1535
1536 unlock(vecs->lock);
1537 /* Now all the waitevent threads will start rushing in. */
1538 while (vecs->lock.depth > 0) {
1539 sleep (1); /* This is weak. */
1540 condlog(3,"Have %d wait event checkers threads to de-alloc, waiting..\n", vecs->lock.depth);
1541 }
1542 pthread_mutex_destroy(vecs->lock.mutex);
1543 FREE(vecs->lock.mutex);

The code in thread 5 before the sleep(1) is:
(gdb) list -
1524
1525 pthread_cancel(check_thr);
1526 pthread_cancel(uevent_thr);
1527 pthread_cancel(uxlsnr_thr);
1528 pthread_cancel(uevq_thr);
1529
1530 free_keys(keys);
1531 keys = NULL;
1532 free_handlers(handlers);
1533 handlers = NULL;
(gdb) list -
1514 /*
1515 * exit path
1516 */
1517 block_signal(SIGHUP, NULL);
1518 lock(vecs->lock);
1519 if (conf->queue_without_daemon == QUE_NO_DAEMON_OFF)
1520 vector_foreach_slot(vecs->mpvec, mpp, i)
1521 dm_queue_if_no_path(mpp->alias, 0);
1522 remove_maps_and_stop_waiters(vecs);
1523 free_pathvec(vecs->pathvec, FREE_PATHS);
(gdb)

So as you can see at line 1523, thread 5 freed vecs->pathvec. Which thread 1 is accessing:
1150 vector_foreach_slot (vecs->pathvec, pp, i) {