Found this while reviewing the 1.6.x-svn_fs_commit_txn backport, but it's present in trunk as well:
When ERR does not contain SVN_ERR_REPOS_POST_COMMIT_HOOK_FAILED, svn_repos__post_commit_error_str() sets hook_err2 to NULL (in the else{} on line 629) and later dereferences it (to get the ->message member). The caller in libsvn_repos/commit.c passes svn_repos_fs_commit_txn()'s return value directly to svn_repos__post_commit_error_str(), so the ERR parameter of svn_repos__post_commit_error_str() may in fact not contain a SVN_ERR_REPOS_POST_COMMIT_HOOK_FAILED link.