Not sure how important it is, but looking at
#15 0x0000000000a99af0 in lyx::to_utf8(std::basic_string<wchar_t,
std::char_traits<wchar_t>, std::allocator<wchar_t> > const&) ()
#16 0x00000000005c6577 in lyx::Paragraph::write(std::ostream&,
lyx::BufferParams const&, unsigned long&) const ()
#17 0x00000000005ed142 in lyx::Text::write(std::ostream&) const ()
#18 0x0000000000830afa in lyx::Tabular::write(std::ostream&) const ()
#19 0x00000000005c6bab in lyx::Paragraph::write(std::ostream&,
lyx::BufferParams const&, unsigned long&) const ()
#20 0x00000000005ed142 in lyx::Text::write(std::ostream&) const ()
#21 0x00000000005c6bab in lyx::Paragraph::write(std::ostream&,
lyx::BufferParams const&, unsigned long&) const ()
#22 0x00000000005ed142 in lyx::Text::write(std::ostream&) const ()
#23 0x000000000048bfa9 in lyx::Buffer::write(std::ostream&) const ()
It looks as if this table is inside some other sort of inset: We are
three calls deep to Text::write.
And what I said before was wrong: There are several flushString calls in
Paragraph::write, so the crashing call to to_utf8 could come in any of
them. The crashing call certainly isn't the first one, since
"\begin_inset Tabluar" does actually get written (and it's hard to see
how that could crash, anyway).
Richard