I've noticed in a few places where what is shared and what is not (ie: local to the worker struct within the child process) are confused.
In my mind, ap_proxy_initialize_worker_share() should worry about things that are (possibly) shared, and thus worker->s entries. It should also be checking worker->s->status as well. Now ap_proxy_initialize_worker() contain worker specific items, and are therefore local to that child process. As such, checking to see if that worker has been initialized by checking worker->s->status ain't quite right, since it means that the *shared* data has been initialized, but that this worker may not have been (if you catch my drift). Furthermore, this means that the ->cp stuff isn't being fully init'ed...
