Thanks again for the helpful response.
My understanding is that Perl will not try to free() a weak reference. But I seem to recall reading that a weak reference is copied as a strong reference. If true, that might explain everything, since the copy will trigger free() on memory already unallocated.
I'm probably out of my league, but I assume that a weak reference copy should also be weak. Is this behavior limited to 5.10 and 5.12? Certainly a neat and tidy explanation and a manageable workaround. You're probably the best resource for sanity checking that theory. And then, is it possible to confirm by rooting around the change logs?
It's always a exciting... and a little scary... to get so close to the internals ;)