I seem to be able to crash Kamailio v3.1 by doing this when handling a REGISTER:
if(!www_authorize("$td", "subscriber")) { # $rc is -1 - "invalid user"
www_challenge("$td", "1"); exit; }
In other words, it cannot find the user, but I call www_challenge() anyway, and get a segfault. Can anyone reproduce, before I attempt to obtain a backtrace?