-libxslt 1.1.4
-libxml 2.6.7
-debian woody width libc6 and gcc from testing
-nothing special


the following crashes xsltproc: 
<elem attr="{1} {1} {1} {1} {1} {1}"/>

if I remove one xpath expression it works. This works:
<elem attr="{1} {1} {1} {1} {1}"/>

I seems to crash if more than 5 xpath expressions are used in one attribute .

in another stylesheet it reproduced a crash if more than 4 xpath expressions are in one 
attribute.

-------test.xsl------------
<?xml version="1.0"?>

<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" >
    <xsl:template match="/root">
        <elem attr="{1} {1} {1} {1} {1} {1}"/>
    </xsl:template>
</xsl:stylesheet>
-------x.xml------------
<?xml version="1.0"?>
<root/>
-------cmd-line-output------------
# xsltproc --verbose test.xsl x.xml
Resolving attribute sets references
<?xml version="1.0"?>
<elem attr="1 1 1 1 1"/>
# xsltproc --verbose test.xsl x.xml
Resolving attribute sets references
<?xml version="1.0"?>
<elem attr="1 1 1 1 1 1"/>
Segmentation fault
#