Here is a link to the bug filed with us (Gentoo), however it lacks gtkhtml symbols ( below you can find my traces with gtkhtml symbols ):
http://bugs.gentoo.org/153477

This problem was originally seen in evolution while using the memo's.

the problem is in src/gtkhtml-stream.c ( around line 106 ):

    len = strlen (result_string);
    g_free (result_string);

    if (len < 8192)
        buf = alloca (len);

    if (buf == NULL)
        buf = mbuf = g_malloc (len);

You can see that if the result_string has a '\0' on the end, the len will be one short ( because strlen doesn't count '\0' ).

This causes various crashes. A couple of the backtraces (truncated) are:
--backtrace 1

+ Trace 84824

In valgrind, you can easily see this:
==11209== Invalid write of size 1
==11209==    at 0x4996DD2: vsprintf (in /lib/libc-2.5.so)
==11209==    by 0x4AA6173: gtk_html_stream_vprintf (gtkhtml-stream.c:108)
==11209==    by 0x4AA61DB: gtk_html_stream_printf (gtkhtml-stream.c:124)
==11209==    by 0x6B81ACE: write_html (e-cal-component-memo-preview.c:240)
==11209==    by 0x6B82369: e_cal_component_memo_preview_display (e-cal-component-memo-preview.c:378)
==11209==    by 0x6BD2EAC: table_cursor_change_cb (e-memos.c:156)
==11209==    by 0x48708DE: g_cclosure_marshal_VOID(i_xx_t) (gmarshal.c:216)
==11209==    by 0x4857926: g_closure_invoke (gclosure.c:490)
==11209==    by 0x486FA7F: signal_emit_unlocked_R (gsignal.c:2440)
==11209==    by 0x486EBE9: g_signal_emit_valist (gsignal.c:2199)
==11209==    by 0x486EEF4: g_signal_emit (gsignal.c:2243)
==11209==    by 0x4D99722: group_cursor_change (e-table.c:758)

==11209==  Address 0x78EDFCC is 0 bytes after a block of size 9,156 alloc'd
==11209==    at 0x40213FD: malloc (in /usr/lib/valgrind/x86-linux/vgpreload_memcheck.so)
==11209==    by 0x48C4ECC: g_malloc (gmem.c:131)
==11209==    by 0x4AA6151: gtk_html_stream_vprintf (gtkhtml-stream.c:106)
==11209==    by 0x4AA61DB: gtk_html_stream_printf (gtkhtml-stream.c:124)
==11209==    by 0x6B81ACE: write_html (e-cal-component-memo-preview.c:240)
==11209==    by 0x6B82369: e_cal_component_memo_preview_display (e-cal-component-memo-preview.c:378)
==11209==    by 0x6BD2EAC: table_cursor_change_cb (e-memos.c:156)
==11209==    by 0x48708DE: g_cclosure_marshal_VOID(i_xx_t) (gmarshal.c:216)
==11209==    by 0x4857926: g_closure_invoke (gclosure.c:490)
==11209==    by 0x486FA7F: signal_emit_unlocked_R (gsignal.c:2440)
==11209==    by 0x486EBE9: g_signal_emit_valist (gsignal.c:2199)
==11209==    by 0x486EEF4: g_signal_emit (gsignal.c:2243)

There are a bunch of bugs ( open/resolved/needinfo ) with similar backtraces ( assigned to evolution component mostly ) so you will probably want to dupe them here.

Attached is a patch, although you will probably want to make it more robust before committing.

Please contact me if you need any more information.