Steps to reproduce:
1. Started Evolution.  It was looking at my Exchange mailbox.  There was an email in the inbox that I had deleted while I was at work.  My home instance of Evolution (attached to the same Exchange server) thought the message still existed in my inbox and it showed up as an unread email.  That has happened to me before.  When I click on this message I get the error "Can't display" or similar, or else sometimes Evolution figures out that it really doesn't exist and removes it.
2. If Evolution says "can't display", then I have to stop/restart evolution, then select the message, and then it will clean it up.  Sometimes I have to do this multiple times.
3. This time I did it once, and I clicked the message that didn't exist.
4. Evolution dumped core


Stack trace:
Core was generated by `/opt/evo/bin/evolution'.
Program terminated with signal 11, Segmentation fault.

+ Trace 164109

(gdb) l
1068    {
1069            HTMLElement *elem = NULL;
1070            GList *l;
1071            gint maxLevel = display;
1072    
1073            l = e->span_stack->list;
1074            
1075            while (l) {
1076                    gint cd;
1077                    elem = l->data;

(gdb) p e
$1 = (HTMLEngine *) 0x83c8518

(gdb) p e->span_stack
$2 = (HTMLStack *) 0x0

Whoops!

(gdb) p *e
$3 = {parent = {g_type_instance = {g_class = 0x83c8318}, ref_count = 0, 
    qdata = 0x0}, draw_queue = 0x0, painter = 0x0, settings = 0x0, 
  defaultSettings = 0x0, undo = 0x0, window = 0x0, invert_gc = 0x0, 
  editable = 0, caret_mode = 0, clipboard = 0x0, clipboard_len = 0, 
  clipboard_stack = 0x0, primary = 0x0, primary_len = 0, freeze_count = 0, 
  thaw_idle_id = 0, block_redraw = 0, need_redraw = 0, pending_expose = 0x0, 
  parsing = 0, ht = 0x0, st = 0x0, clue = 0x0, flow = 0x86b0420, 
  leftBorder = 10, rightBorder = 10, topBorder = 10, bottomBorder = 10, 
  indent_level = 0, width = 1002, height = 2851, parseCount = 0, 
  granularity = 0, x_offset = 0, y_offset = 0, inTitle = 0, inPre = 0, 
  inOption = 0, inTextArea = 0, eat_space = 0, allow_frameset = 0, 
  newPage = 0, begin = 0, span_stack = 0x0, clueflow_style_stack = 0x0, 
  frame_stack = 0x0, body_stack = 0x0, table_stack = 0x0, url = 0x0, 
  target = 0x0, updateTimer = 0, timerId = 0, redraw_idle_id = 0, 
  title = 0x86a5bd0, writing = 0, bgPixmapPtr = 0x0, listStack = 0x0, 
  embeddedStack = 0x0, widget = 0x842a540, image_factory = 0x0, 
  tempStrings = 0x0, map = 0x0, form = 0x0, formSelect = 0x0, 
  formTextArea = 0x0, formList = 0x0, formText = 0x86cdec0, avoid_para = 1, 
  have_focus = 0, selection = 0x0, selected_in = 0, cursor = 0x0, mark = 0x0, 
  cursor_hide_count = 0, blinking_timer_id = 0, blinking_status = 0, 
  insertion_font_style = GTK_HTML_FONT_STYLE_DEFAULT, insertion_color = 0x0, 
  insertion_url = 0x0, insertion_target = 0x0, shift_selection = 0, 
  selection_updater = 0x0, selection_stack = 0x0, search_info = 0x0, 
  replace_info = 0x0, id_table = 0x0, class_data = 0x0, map_table = 0x0, 
  min_split_index = 0.75, need_spell_check = 0, block_events = 0, 
  language = 0x0, cursor_position_stack = 0x0, selection_mode = 0, 
  block_selection = 0, cursor_cell = {object = 0x0, x1 = 0, y1 = 0, x2 = 0, 
    y2 = 0}, cursor_table = {object = 0x0, x1 = 0, y1 = 0, x2 = 0, y2 = 0}, 
  cursor_image = {object = 0x0, x1 = 0, y1 = 0, x2 = 0, y2 = 0}, 
  cut_and_paste_stack = 0x0, block = 0, block_images = 0, opened_streams = 1, 
  stopped = 0, keep_scroll = 0, focus_object = 0x0, focus_object_offset = 0, 
  save_data = 0, saved_step_count = -1, expose = 0, need_update = 0, 
  parser_clue = 0x0}


Other information:
This is Evo (et.al.) built from the end of the gnome-2-20 branch in SVN, as of the evening of Thursday, 20 Sep 2007.

Here are some log files; don't know if they'll help
----------------------------
Thread b2a88b90 >
CamelFolder:get_message('personal/Inbox', '0000000134a9') =
class: CamelMimeMessage
mime-type: text/html; charset=iso-8859-1
content class: CamelDataWrapper
content mime-type: text/html; charset=iso-8859-1
< b2a88b90 >
Thread b4c61b90 >
Get folder info(0x82a1200:exchange://psmith;auth=Basic@exchserv.mycorp.com/, '<null>') =
  uri: exchange://psmith;auth=Basic@exchserv.mycorp.com/personal
  full_name: personal
  flags: 00000001
    uri: exchange://psmith;auth=Basic@exchserv.mycorp.com/personal/Deleted%20Items
    full_name: personal/Deleted Items
    flags: 00000008
    uri: exchange://psmith;auth=Basic@exchserv.mycorp.com/personal/Drafts
    full_name: personal/Drafts
    flags: 00000008
    uri: exchange://psmith;auth=Basic@exchserv.mycorp.com/personal/Inbox
    full_name: personal/Inbox
    flags: 00000448
    uri: exchange://psmith;auth=Basic@exchserv.mycorp.com/personal/Journal
    full_name: personal/Journal
    flags: 00000008
    uri: exchange://psmith;auth=Basic@exchserv.mycorp.com/personal/Junk%20E-mail
    full_name: personal/Junk E-mail
    flags: 00000008
    uri: exchange://psmith;auth=Basic@exchserv.mycorp.com/personal/mycorp
    full_name: personal/mycorp
    flags: 00000000
      uri: exchange://psmith;auth=Basic@exchserv.mycorp.com/personal/mycorp/afolder
      full_name: personal/mycorp/afolder
      flags: 00000008
      uri: exchange://psmith;auth=Basic@exchserv.mycorp.com/personal/mycorp/Corporate
      full_name: personal/mycorp/Corporate
      flags: 00000008
      uri: exchange://psmith;auth=Basic@exchserv.mycorp.com/personal/mycorp/Linux%20xxx
      full_name: personal/mycorp/Linux
(evolution:10366): GLib-GObject-WARNING **: invalid uninstantiatable type `<invalid>' in cast to `HTMLEngine'

(evolution:10366): gtkhtml-CRITICAL **: html_tokenizer_end: assertion `t && HTML_IS_TOKENIZER (t)' failed

(evolution:10366): gtkhtml-CRITICAL **: html_tokenizer_has_more_tokens: assertion `t && HTML_IS_TOKENIZER (t)' failed

(evolution:10366): gtkhtml-CRITICAL **: html_tokenizer_has_more_tokens: assertion `t && HTML_IS_TOKENIZER (t)' failed

(evolution:10366): gtkhtml-CRITICAL **: html_tokenizer_has_more_tokens: assertion `t && HTML_IS_TOKENIZER (t)' failed
-----------------------------------