You're right -- that code was broken. Thanks for the patch; I've now applied it to CVS with the following ChangeLog entry:
2003-10-15 Philip Stadermann <[EMAIL PROTECTED]>
* ftp.c (ftp_retrieve_glob): Correctly loop through the list whose
elements might have been deleted.
