In src/core/prefs.c:init_bindings, the following code is used to handle keybindins defined as gconf string list.
            {
              list_val = gconf_client_get_list (default_client, key, GCONF_VALUE_STRING, NULL);

              update_key_list_binding (key, list_val);
              g_slist_foreach (list_val, (GFunc)g_free, NULL);
              g_slist_free (list_val);
            }
update_key_list_binding requires a GList of gconf value but gconf_client_get_list returns a GList of string so in update_key_list_binding metacity will crash because of a NULL pointer.

The other platform will probably not crash but the problem is still there.