After reverting this change (that Richard took from trunk and put in our rpm), it seems to be much more stable:

diff --git a/egg/egg-secure-memory.c b/egg/egg-secure-memory.c
index a215364..ba0cf5c 100644
--- a/egg/egg-secure-memory.c
+++ b/egg/egg-secure-memory.c
@@ -341,7 +341,7 @@ sec_insert_cell_ring (Cell **ring, Cell *cell)
        /* Insert back into the mix of available memory */ 
        if (*ring) { 
                cell->next = (*ring)->next;
-               cell->prev = (*ring)->prev;
+               cell->prev = *ring;
                cell->next->prev = cell;
                cell->prev->next = cell;
        } else {

Thanks for catching that. I've committed another fix to the SVN gnome-2-26 branch which should fix this problem: r1717