Related to bug #349967, there appears to be a refcounting bug for the window widget that causes it to be dereferenced and freed before it's size is stored.  This is how the invalid default sizes got stored to cause the problem in that bug.  Here's the backtrace for this problem:

+ Trace 70162

Here's the window object in store_window_size():

(gdb) p *widget
$2 = {object = {parent_instance = {g_type_instance = {g_class = 0x63b3e0}, 
      ref_count = 0, qdata = 0xaaaaaaaaaaaaaaaa}, flags = 2863311530}, 
  private_flags = 43690, state = 170 '�', saved_state = 170 '�', 
  name = 0xaaaaaaaaaaaaaaaa <Address 0xaaaaaaaaaaaaaaaa out of bounds>, 
  style = 0xaaaaaaaaaaaaaaaa, requisition = {width = -1431655766, height = -1431655766}, 
  allocation = {x = -1431655766, y = -1431655766, width = -1431655766, 
    height = -1431655766}, window = 0xaaaaaaaaaaaaaaaa, parent = 0xaaaaaaaaaaaaaaaa}


Note the refcount of 0, and the garbage everywhere.

Unfortunately, I have no idea what would have caused this.  This particular core happened on shutdown, and I only noticed it when my evo started up the next time with default sizes.