I have a similar stack trace maybe related to this, happens often a network user tries to access a network device, he got the windows messages that the network share is not available, smbd crashes and after that, the user can access the network share. But from time to time, the crash continues and only a complee restart of samba has to be done.

[Thread debugging using libthread_db enabled]
[New Thread 0x7f02cd972700 (LWP 6430)]
0x00007f02cab804a5 in waitpid () from /lib/libc.so.6
#0  0x00007f02cab804a5 in waitpid () from /lib/libc.so.6
#1  0x00007f02cab21461 in ?? () from /lib/libc.so.6
#2  0x0000000000613c4b in smb_panic (why=<value optimized out>)
    at lib/util.c:1639
#3  0x0000000000618cc1 in assert_uid (ruid=4294967295, euid=1001)
    at lib/util_sec.c:102
#4  0x00000000004ba57e in become_id (uid=1001, gid=100) at smbd/sec_ctx.c:57
#5  0x00000000004ba6f6 in pop_sec_ctx () at smbd/sec_ctx.c:345
#6  0x00000000004afec9 in unbecome_root () at smbd/uid.c:400
#7  0x00000000005d36b8 in gid_to_sid (psid=0x7fffd5990990, gid=100)
    at passdb/lookup_sid.c:1202
#8  0x00000000004c432a in get_nt_acl (fsp=0xb16fb0, security_info=7, 
    ppdesc=0x7fffd5990ac8) at smbd/posix_acls.c:2809
#9  0x000000000046e06e in is_visible_file (conn=0xab9240, 
    dir_path=0xa85ce0 "./", name=<value optimized out>, pst=0x7fffd5991490, 
    use_veto=1) at smbd/dir.c:897
#10 0x000000000046e5f0 in dptr_normal_ReadDirName (dptr=0xa13ff0, 
    poffset=0x7fffd5991558, pst=0x7fffd5991490) at smbd/dir.c:562
#11 0x000000000046e664 in dptr_ReadDirName (dptr=0xa13ff0, 
    poffset=0x7fffd5991558, pst=0x7fffd5991490) at smbd/dir.c:642
#12 0x00000000004a54b4 in get_lanman2_dir_entry (conn=0xab9240, 
    inbuf=<value optimized out>, outbuf=0xadefb0 "", 
    path_mask=0x7fffd5992770 "*", dirtype=22, info_level=260, 
    requires_resume_key=4, dont_descend=0, ppdata=0x7fffd5992740, 
    base_data=0xaff400 "`", end_data=0xb043ff "", space_remaining=10504, 
    out_of_space=0x7fffd5992764, got_exact_match=0x7fffd599274c, 
    last_entry_off=0x7fffd599276c, name_list=0x0, ea_ctx=0x0)
    at smbd/trans2.c:1149
#13 0x00000000004a8ae3 in call_trans2findfirst (conn=0xab9240, 
    inbuf=0xabeb60 "", outbuf=0xadefb0 "", bufsize=131072, pparams=0xabd460, 
    total_params=<value optimized out>, ppdata=0xabd470, total_data=0, 
    max_data_bytes=16384) at smbd/trans2.c:1859
#14 0x00000000004a927e in handle_trans2 (conn=0xab9240, state=0xabd310, 
    inbuf=0xabeb60 "", outbuf=0xadefb0 "", size=<value optimized out>, 
    bufsize=131072) at smbd/trans2.c:6433
#15 0x00000000004afc3a in reply_trans2 (conn=0xab9240, inbuf=0xabeb60 "", 
    outbuf=0xadefb0 "", size=90, bufsize=131072) at smbd/trans2.c:6703
#16 0x00000000004c879e in switch_message (type=50, inbuf=0xabeb60 "", 
    outbuf=0xadefb0 "", size=90, bufsize=131072) at smbd/process.c:1004
#17 0x00000000004c9b92 in smbd_process () at smbd/process.c:1031
#18 0x00000000006c5f6d in main (argc=<value optimized out>, 
    argv=0x7fffd59946f8) at smbd/server.c:1120

Hier the host log entry:

[2008/10/06 08:49:27, 0] lib/util_sec.c:set_effective_uid(205)
  setresuid failed with EAGAIN. uid(1001) might be over its NPROC limit
[2008/10/06 08:49:27, 0] lib/util_sec.c:assert_uid(101)
  Failed to set uid privileges to (-1,1001) now set to (0,0)
[2008/10/06 08:49:27, 0] lib/util.c:smb_panic(1633)
  PANIC (pid 6517): failed to set uid
  
[2008/10/06 08:49:27, 0] lib/util.c:log_stack_trace(1737)
  BACKTRACE: 20 stack frames:
   #0 /usr/sbin/smbd(log_stack_trace+0x1c) [0x613b1c]
   #1 /usr/sbin/smbd(smb_panic+0x43) [0x613c03]
   #2 /usr/sbin/smbd [0x618cc1]
   #3 /usr/sbin/smbd [0x4ba57e]
   #4 /usr/sbin/smbd(pop_sec_ctx+0x96) [0x4ba6f6]
   #5 /usr/sbin/smbd(unbecome_root+0x9) [0x4afec9]
   #6 /usr/sbin/smbd(gid_to_sid+0x168) [0x5d36b8]
   #7 /usr/sbin/smbd(get_nt_acl+0x44a) [0x4c432a]
   #8 /usr/sbin/smbd(is_visible_file+0x26e) [0x46e06e]
   #9 /usr/sbin/smbd [0x46e5f0]
   #10 /usr/sbin/smbd(dptr_ReadDirName+0x54) [0x46e664]
   #11 /usr/sbin/smbd [0x4a54b4]
   #12 /usr/sbin/smbd [0x4a8ae3]
   #13 /usr/sbin/smbd(handle_trans2+0x1be) [0x4a927e]
   #14 /usr/sbin/smbd(reply_trans2+0x6ea) [0x4afc3a]
   #15 /usr/sbin/smbd [0x4c879e]
   #16 /usr/sbin/smbd(smbd_process+0x7e2) [0x4c9b92]
   #17 /usr/sbin/smbd(main+0x8cd) [0x6c5f6d]
   #18 /lib/libc.so.6(__libc_start_main+0xf4) [0x7f22689ce1c4]
   #19 /usr/sbin/smbd [0x45a869]
[2008/10/06 08:49:27, 0] lib/fault.c:dump_core(181)
  dumping core in /var/log/samba/cores/smbd

I commented out the panic-action script to get rid of the email notifications.

root@atlantis:/etc/samba# testparm -S /etc/samba/smb.conf
Load smb config files from /etc/samba/smb.conf
Processing section "[homes]"
Processing section "[printers]"
Processing section "[public]"
Processing section "[fax]"
Processing section "[netlogon]"
Processing section "[profile]"
Processing section "[hplj1100]"
Loaded services file OK.
Invalid combination of parameters for service hplj1100. 			   Level II oplocks can only be set if oplocks are also set.
Server role: ROLE_DOMAIN_PDC
Press enter to see a dump of your service definitions

[global]
	workgroup = NCC1701
	server string = %h server (Samba %v)
	interfaces = 127.0.0.1, 192.168.0.0/24
	bind interfaces only = Yes
	obey pam restrictions = Yes
	passwd program = /usr/bin/passwd %u
	passwd chat = *Enter\snew\sUNIX\spassword:* %n\n *Retype\snew\sUNIX\spassword:* %n\n .
	unix password sync = Yes
	syslog = 0
	log file = /var/log/samba/log.%m
	max log size = 1000
	time server = Yes
	logon script = netlogon.bat
	logon path = \\%N\%U\profile\%a
	logon drive = H:
	domain logons = Yes
	os level = 65
	preferred master = Yes
	domain master = Yes
	wins support = Yes
	preload = homes
	hide unreadable = Yes

[homes]
	comment = Home Directories
	read only = No
	create mask = 0700
	directory mask = 0700
	browseable = No

[printers]
	comment = All Printers
	path = /tmp
	create mask = 0700
	guest ok = Yes
	printable = Yes
	browseable = No

[public]
	path = /home/public
	write list = berni, henning
	read only = No
	directory mask = 0775

[fax]
	comment = Eingehende Faxe
	path = /var/spool/hylafax/recvq
	write list = berni, henning

[netlogon]
	comment = Domain-Anmeldedienst
	path = /home/samba/netlogon/%a
	write list = root, berni
	browseable = No

[profile]
	path = /home/%u
	read only = No
	create mask = 0700
	directory mask = 0700
	browseable = No

[hplj1100]
	comment = hplj1100
	path = /tmp
	read only = No
	create mask = 0700
	guest ok = Yes
	printable = Yes
	printer name = hplj1100
	oplocks = No
	share modes = No

root@atlantis:/etc/samba# /usr/lib/debug/usr/sbin/smbd -F
-bash: /usr/lib/debug/usr/sbin/smbd: cannot execute binary file