Comment 2 for bug 137989

I see exactly the same behaviour on Gutsy x86-64 (0.6.5-0ubuntu10 network-manager-applet package);
here is a backtrace:
[Switching to Thread 47165236416624 (LWP 7232)]
0x00002ae57b231f18 in gtk_combo_box_set_model ()
   from /usr/lib/libgtk-x11-2.0.so.0
(gdb) where
#0 0x00002ae57b231f18 in gtk_combo_box_set_model ()
   from /usr/lib/libgtk-x11-2.0.so.0
#1 0x000000000041c008 in ?? ()
#2 0x000000000041a250 in ?? ()
#3 0x0000000000417551 in ?? ()
#4 0x00002ae57f28699a in g_closure_invoke () from /usr/lib/libgobject-2.0.so.0
#5 0x00002ae57f2966b8 in ?? () from /usr/lib/libgobject-2.0.so.0
#6 0x00002ae57f297af3 in g_signal_emit_valist ()
   from /usr/lib/libgobject-2.0.so.0
#7 0x00002ae57f297cc3 in g_signal_emit () from /usr/lib/libgobject-2.0.so.0
#8 0x00002ae57b3d12fa in gtk_widget_activate ()
   from /usr/lib/libgtk-x11-2.0.so.0
#9 0x00002ae57b2d33e0 in gtk_menu_shell_activate_item ()
   from /usr/lib/libgtk-x11-2.0.so.0
#10 0x00002ae57b2d4da6 in ?? () from /usr/lib/libgtk-x11-2.0.so.0
#11 0x00002ae57b2c715d in _gtk_marshal_BOOLEAN__BOXED ()
   from /usr/lib/libgtk-x11-2.0.so.0
#12 0x00002ae57f28699a in g_closure_invoke () from /usr/lib/libgobject-2.0.so.0
#13 0x00002ae57f296cc8 in ?? () from /usr/lib/libgobject-2.0.so.0
#14 0x00002ae57f2978c7 in g_signal_emit_valist ()
   from /usr/lib/libgobject-2.0.so.0
#15 0x00002ae57f297cc3 in g_signal_emit () from /usr/lib/libgobject-2.0.so.0
#16 0x00002ae57b3cd0ae in ?? () from /usr/lib/libgtk-x11-2.0.so.0
---Type <return> to continue, or q <return> to quit---
#17 0x00002ae57b2c04fb in gtk_propagate_event ()
   from /usr/lib/libgtk-x11-2.0.so.0
#18 0x00002ae57b2c1504 in gtk_main_do_event ()
   from /usr/lib/libgtk-x11-2.0.so.0
#19 0x00002ae57b79617c in ?? () from /usr/lib/libgdk-x11-2.0.so.0
#20 0x00002ae57f93bfd3 in g_main_context_dispatch ()
   from /usr/lib/libglib-2.0.so.0
#21 0x00002ae57f93f2dd in ?? () from /usr/lib/libglib-2.0.so.0
#22 0x00002ae57f93f5ea in g_main_loop_run () from /usr/lib/libglib-2.0.so.0
#23 0x00002ae57b2c1883 in gtk_main () from /usr/lib/libgtk-x11-2.0.so.0
#24 0x0000000000409fe1 in ?? ()
#25 0x00002ae58001ab44 in __libc_start_main () from /lib/libc.so.6
#26 0x0000000000409e79 in ?? ()
#27 0x00007fff31b98278 in ?? ()
#28 0x0000000000000000 in ?? ()

and I get a kernel log of:

[17944.979590] nm-applet[6868]: segfault at ffffffffac022dc0 rip 00002b027016df18 rsp 00007fff3cc59540 error 4
(all address varying on each run)

It happens with my kill switch on or off; the wireless is:
05:00.0 Network controller: Intel Corporation PRO/Wireless 3945ABG Network Connection (rev 02)

in a Tosh Equium A100 Pro; but it doesn't feel device driver to me.

Dave