The crash seems to happen when idata->ctx is NULL on line 233 in imap_mailbox_state().
The attached patch seems to at least work around the problem. -- Dafydd
--- mutt.orig/imap/browse.c 2008-09-04 11:38:19.000000000 +0100 +++ mutt/imap/browse.c 2008-09-04 11:38:31.000000000 +0100 @@ -228,7 +228,7 @@ return -1; } - if (!imap_mxcmp(mx.mbox, idata->mailbox)) + if (!imap_mxcmp(mx.mbox, idata->mailbox) && idata->ctx) { state->new = idata->ctx->new; state->messages = idata->ctx->msgcount;