The following diff fixes this issue. The problem was in fact that $msg->{to} is empty in MailScanner/Config.pm (around line 446):
if ($direction =~ /t/) { # Match against every To address if (defined $tooverride) { push @matches, split(" ",$value) if $tooverride =~ /$regexp/; } else { foreach $to (@{$msg->{to}}) { push @matches, split(" ",$value) if $to =~ /$regexp/; } } } The reason is that Config (MailScanner/Config.pm) is called from MailScanner/Quarantine.pm with the wrong message argument: "$this" instead of "$message".
--- mailscanner-4.41.3.orig/lib/MailScanner/Quarantine.pm 2005-03-20 13:50:57.000000000 +0100 +++ mailscanner-4.41.3.corrected/lib/MailScanner/Quarantine.pm 2006-01-06 15:34:41.000000000 +0100 @@ -191,7 +191,7 @@ # messages, not just infections. umask $this->{fileumask}; if ($message->{allreports}{""} || - MailScanner::Config::Value('quarantinewholemessage',$this) =~ /1/) { + MailScanner::Config::Value('quarantinewholemessage',$message) =~ /1/) { #print STDERR "Saving entire message to $msgdir\n"; MailScanner::Log::InfoLog("Saved entire message to $msgdir"); $message->{store}->CopyEntireMessage($message, $msgdir, 'message',