A segfault occurs when attempting to edit any ticket in the system.  Tracing the problem with DDD, the issue seems to flow from tktedit_page, Th_Render, Th_Eval, thEvalLocal, thSplitList, thSubstWord, and finally to Th_HashFind where it segfaults on the following line:

if( pRet->nKey==nKey && 0==memcmp(pRet->zKey, zKey, nKey) ) break