If the applet starts with no killswitches installed, the following code in main.c destroys the killswitch object:
        if (bluetooth_killswitch_has_killswitches (killswitch) == FALSE) {
                g_object_unref (killswitch);
                killswitch = NULL;
        }

However, the destructor for the killswitch object (bluetooth_killswitch_finalize) fails to cleanup the io_watch set in its constructor. So when a killswitch is connected later, the event_cb for the killswitch object runs, and attempts to use the now-destructed killswitch object. The result is a crash.

The problems here are twofold:
* Just because we don't have a killswitch now, doesn't mean we won't get one later (the user may attach a bluetooth interface with one). Thus we shouldn't destroy the killswitch object just because it doesn't have any yet.
* The killswitch finalizer fails to fully clean up after the constructor.

I've attached a patch against latest git to fix this issue; I'm not too familiar with the code, so please give it a thorough review before applying.

Note that this issue is easily reproducible with a USB dongle that includes a killswitch; start the applet with zero bluetooth devices, then plug in the dongle. It's been affecting a number of ubuntu users at https://bugs.edge.launchpad.net/ubuntu/+source/gnome-bluetooth/+bug/445422 , so it's not just theoretical :)