Sorry to immediately reply to my own post, but I found which part of the input was triggering the bug.
In the pv__format() function, from line 788, there is a large "switch" section. Two of the cases in that switch declare some local variables (lines 917 and 996). Moving both of those local variable declarations out to the block enclosing the "switch" (line 769) stops splint from crashing out. So it was local variable declarations inside a "case" statement that were triggering the fault. -- Andrew Wood
