The bug was introduced with version [53aef2dee1] in
<verbatim>int vfile_top_of_checkout(const char *zPath)</verbatim>

The mprintf is called without zPath. I added some debug output and saw that the first zFile contains a valid path but the second one contained garbage.

I don't know why it works for the first call, but the second crashes fossil under Windows.

Here is a correction:
<verbatim>
Index: src/vfile.c
===================================================================
--- src/vfile.c
+++ src/vfile.c
@@ -301,15 +301,15 @@
 */
 int vfile_top_of_checkout(const char *zPath){
   char *zFile;
   int fileFound = 0;

-  zFile = mprintf("%s/_FOSSIL_");
+  zFile = mprintf("%s/_FOSSIL_",zPath);
   fileFound = file_size(zFile)>=1024;
   fossil_free(zFile);
   if( !fileFound ){
-    zFile = mprintf("%s/.fos");
+    zFile = mprintf("%s/.fos",zPath);
     fileFound = file_size(zFile)>=1024;
     fossil_free(zFile);
   }
   return fileFound;
 }
</verbatim>