here is another backtrace - it looks like as if in gst_pad_get_scheduler()
gst_pad_get_parent(pad); returns something that is not NUL but not a GstElement.

+ Trace 51374

BBB says:
audioconvert doesn't handle readonly buffers

iggnore #2 belongs to different buf

Breakpoint 1, gst_pad_get_scheduler (pad=0x826c120) at gstpad.c:1974
1974        if (GST_FLAG_IS_SET (parent, GST_ELEMENT_DECOUPLED)) {
(gdb) print *parent
$3 = {object = {object = {g_type_instance = {g_class = 0x82772d8}, ref_count =
1083131240, qdata = 0x34303878}, name = 0x30323866 <Address 0x30323866 out of
bounds>, lock = 0x33202d20,
    parent = 0x39323530, flags = 959724082, _gst_reserved = {0x2e39313a,
0x34353932, 0x30303236, 0x1b202930}}, current_state = 91 '[', pending_state = 48
'0', loopfunc = 0x20202020,
  sched = 0x20202020, sched_private = 0x632d7462, clock = 0x1b65726f, base_time
= 3700581379259510875, numpads = 12595, numsrcpads = 12909, numsinkpads = 13622,
pads = 0x30305b1b,
  state_mutex = 0x1b20296d, state_cond = 0x6d30305b, pre_run_func = 0x6863616d,
post_run_func = 0x2e656e69, prop_value_queue = 0x39352863, property_mutex =
0x623a2935, _gst_reserved = {
    0x616d5f74, 0x6e696863, 0x69645f65, 0x736f7073}}

just a few lines before in my own code I remove another element (which works)
and there the same output from gdb look sane:
(gdb) print *parent
$2 = {object = {object = {g_type_instance = {g_class = 0x826d8c0}, ref_count =
2, qdata = 0x0}, name = 0x826ede8 "input_level_0x8269be0", lock = 0x826e5b8,
parent = 0x8249dc8, flags = 0,
    _gst_reserved = {0x0, 0x0, 0x0, 0x0}}, current_state = 1 '\001',
pending_state = 0 '\0', loopfunc = 0, sched = 0x824b060, sched_private =
0x826ee28, clock = 0x0, base_time = 0,
  numpads = 2, numsrcpads = 1, numsinkpads = 1, pads = 0x82257d8, state_mutex =
0x826e5d8, state_cond = 0x826e5f8, pre_run_func = 0, post_run_func = 0,
prop_value_queue = 0x804e2e8,
  property_mutex = 0x826f288, _gst_reserved = {0x0, 0x0, 0x0, 0x0}}


The calling code looks like:
    g_assert(GST_IS_BIN(self->priv->bin));
    if(self->priv->spreader) {
      g_assert(GST_IS_ELEMENT(self->priv->spreader));
      gst_bin_remove(self->priv->bin,self->priv->spreader);
    }
    if(self->priv->input_level) {
      g_assert(GST_IS_ELEMENT(self->priv->input_level));
      gst_bin_remove(self->priv->bin,self->priv->input_level);
    }

Created attachment 33304 [details]
reproduces the bug

compile:
gcc -Wall -g `pkg-config gstreamer-0.8 --cflags --libs` gst4.c -o gst4

run:
gdb --args ./gst4 --gst-debug="*:3"

Comment on attachment 33304 [details]
reproduces the bug

when using fakesink/fakesource or alsasink/alsasource it works - so I conclude
its in esdsink

Created attachment 33305 [details]
reproduces the bug

now has some defines to play around with it

I fixed the esdsink dispose function here:
http://freedesktop.org/cgi-bin/viewcvs.cgi/gstreamer/gst-plugins/ext/esd/esdsink.c.diff?r1=1.41&r2=1.42