OK; I'm just guessing at this point, so you may need to track this bug down yourself.
I'll do what I can - long time since I wrote any C though.
#2 0xfe1d5a40 in ApacheCookie_new (r=0x1380960) at apache_cookie.c:79
#3 0xfe1d3550 in XS_Apache__Cookie_parse (cv=0xe7cce4) at Cookie.xs:208
#4 0x001c8bf0 in Perl_pp_entersub () at pp_hot.c:2840
#5 0x00196538 in Perl_runops_debug () at dump.c:1438
#6 0x0010fdec in S_call_body (myop=0xffbef630, is_eval=0) at perl.c:2221
#7 0x0010f7f4 in Perl_call_sv (sv=0x1088a4c, flags=4) at perl.c:2139
#8 0x0004bce4 in perl_call_handler (sv=0x1088a4c, r=0x12481f8, args=0x0) at
mod_perl.c:1668
Notice that "r" has changed between frames 2 and 8. Since XS_Apache__Cookie_parse retrieves r from modperl's perl_request_rec (the XS version of Apache->request), perhaps the problem relates to that function?
Having a quick look, and there are SSI's involved which would explain the different request records, although the record in frame 2 doesn't seem right.
Shall continue next week...
Thanks
Carl