Comment 7 for bug 620430

This is indeed because of the mpris plugin. Relevant part of the stack is just:

#0 0x00172642 in rb_shell_player_get_playback_state (player=0x822d000, shuffle=0x0, repeat=0xbfffefcc) at rb-shell-player.c:1817
#1 0x038005a3 in get_loop_status (plugin=<value optimized out>) at rb-mpris-plugin.c:570
#2 0x038020bf in play_order_changed_cb (object=0x822d000, pspec=0x81e3760, plugin=0x831f2a0) at rb-mpris-plugin.c:784

Specifically, get_loop_status in rb-mpris-plugin.c does:

rb_shell_player_get_playback_state (plugin->player, NULL, &loop);

(passing NULL for the gboolean* shuffle), and rhythmbox itself then segfaults doing:

 *shuffle = i > 0;

(using that gboolean* assuming it is not NULL).

Either passing a valid pointer to an (unused) gboolean in the mpris plugin or teaching the rhythmbox core to check these gboolean*s for NULL before using them should fix the bug.