That bug has been opened on https://launchpad.net/ubuntu/+source/rhythmbox/+bug/78041

"Binary package hint: rhythmbox

Architecture: i386
Version: 0.9.7-0ubuntu2

enabling and disabling Last.fm plugin on "Configure plugins" dialog few times leads to a crash. I'll submit a full backtrace once -dbg package is available (#78040) or I get a chance to rebuild the package.
...
http://librarian.launchpad.net/6090526/backtrace.txt
backtrace.txt

Here's the backtrace with debug symbols.
...

+ Trace 107625

Sure thing, attaching valgrind log
...
==29328== 51 errors in context 50 of 54:
==29328== Invalid read of size 4
==29328==    at 0x80C6851: rhythmdb_entry_get_boolean (rhythmdb.c:4386)
==29328==    by 0x80D66B8: idle_process_update (rhythmdb-query-model.c:1043)
==29328==    by 0x80D97BF: rhythmdb_query_results_add_results (rhythmdb-query-results.c:64)
==29328==    by 0x80DB2D0: rhythmdb_tree_do_full_query (rhythmdb-tree.c:2092)
==29328==    by 0x80C8510: rhythmdb_query_internal (rhythmdb.c:3345)
==29328==    by 0x80C8602: rhythmdb_do_full_query_internal (rhythmdb.c:3440)
==29328==    by 0x778738D: rb_lastfm_source_constructor (rb-lastfm-source.c:651)
==29328==    by 0x4D55A6A: g_object_newv (gobject.c:937)
==29328==    by 0x4D56678: g_object_new_valist (gobject.c:1022)
==29328==    by 0x4D5677F: g_object_new (gobject.c:795)
==29328==    by 0x778530C: rb_lastfm_source_new (rb-lastfm-source.c:531)
==29328==    by 0x7781BC4: impl_activate (rb-audioscrobbler-plugin.c:145)
==29328==  Address 0x780D8C0 is 0 bytes inside a block of size 160 free'd
==29328==    at 0x401FF9A: free (vg_replace_malloc.c:233)
==29328==    by 0x4EE3F90: g_free (gmem.c:187)
==29328==    by 0x80C7E60: rhythmdb_entry_unref (rhythmdb.c:1273)
==29328==    by 0x4ECFBC5: g_hash_nodes_destroy (ghash.c:781)
==29328==    by 0x4ED0023: g_hash_table_remove_all (ghash.c:468)
==29328==    by 0x4ED0282: g_hash_table_destroy (ghash.c:221)
==29328==    by 0x80D8F19: rhythmdb_query_model_finalize (rhythmdb-query-model.c:678)
==29328==    by 0x4D5297B: g_object_unref (gobject.c:1788)
==29328==    by 0x808F246: rb_source_finalize (rb-source.c:336)
==29328==    by 0x7787E2D: rb_lastfm_source_finalize (rb-lastfm-source.c:317)
==29328==    by 0x4D5297B: g_object_unref (gobject.c:1788)
==29328==    by 0x4D52BB7: g_value_object_free_value (gobject.c:1908)
==29328== 
==29328== 51 errors in context 51 of 54:
==29328== Invalid read of size 4
==29328==    at 0x80C874E: rhythmdb_entry_ref (rhythmdb.c:1247)
==29328==    by 0x80D6FEF: rhythmdb_query_model_add_results (rhythmdb-query-model.c:1928)
==29328==    by 0x80D97BF: rhythmdb_query_results_add_results (rhythmdb-query-results.c:64)
==29328==    by 0x80DB2D0: rhythmdb_tree_do_full_query (rhythmdb-tree.c:2092)
==29328==    by 0x80C8510: rhythmdb_query_internal (rhythmdb.c:3345)
==29328==    by 0x80C8602: rhythmdb_do_full_query_internal (rhythmdb.c:3440)
==29328==    by 0x778738D: rb_lastfm_source_constructor (rb-lastfm-source.c:651)
==29328==    by 0x4D55A6A: g_object_newv (gobject.c:937)
==29328==    by 0x4D56678: g_object_new_valist (gobject.c:1022)
==29328==    by 0x4D5677F: g_object_new (gobject.c:795)
==29328==    by 0x778530C: rb_lastfm_source_new (rb-lastfm-source.c:531)
==29328==    by 0x7781BC4: impl_activate (rb-audioscrobbler-plugin.c:145)
==29328==  Address 0x780D8C4 is 4 bytes inside a block of size 160 free'd
==29328==    at 0x401FF9A: free (vg_replace_malloc.c:233)
==29328==    by 0x4EE3F90: g_free (gmem.c:187)
==29328==    by 0x80C7E60: rhythmdb_entry_unref (rhythmdb.c:1273)
==29328==    by 0x4ECFBC5: g_hash_nodes_destroy (ghash.c:781)
==29328==    by 0x4ED0023: g_hash_table_remove_all (ghash.c:468)
==29328==    by 0x4ED0282: g_hash_table_destroy (ghash.c:221)
==29328==    by 0x80D8F19: rhythmdb_query_model_finalize (rhythmdb-query-model.c:678)
==29328==    by 0x4D5297B: g_object_unref (gobject.c:1788)
==29328==    by 0x808F246: rb_source_finalize (rb-source.c:336)
==29328==    by 0x7787E2D: rb_lastfm_source_finalize (rb-lastfm-source.c:317)
==29328==    by 0x4D5297B: g_object_unref (gobject.c:1788)
==29328==    by 0x4D52BB7: g_value_object_free_value (gobject.c:1908)
..."