I'm getting a segfault when performing a certain operation (described below).
I'm not sure what exactly triggers this, although it seems to be the removal of
the [homes] section combined with a sighup signal. So, here it goes:

1) I start with this simple smb.conf file:
[globals]
        workgroup = TESTING
        server string = Testing server
        log file = /var/log/samba/%m.log
        max log size = 50
        log level = 1
        name resolve order = lmhosts bcast
        unix charset = iso-8859-1
        security = user
        passdb backend = tdbsam

[data]
        path = /data
        browseable = yes
        writable = yes

[homes]
       browseable = no
       writable = yes

2) start samba (smbd and nmbd) and run "smbclient -L pandora -N" (pandora is the
machine's netbios name). It works.

3) Edit smb.conf and comment the [homes] section:
(...)
        browseable = yes
        writable = yes

#[homes]
#       browseable = no
#       writable = yes

4) issue "smbcontrol smbd reload-config"

5) Run "smbclient -L pandora -N" again. This time it fails:
# smbclient -L pandora -N
Anonymous login successful
Domain=[TESTING] OS=[Unix] Server=[Samba 3.0.8pre2]

        Sharename       Type      Comment
        ---------       ----      -------
Error returning browse list: Call returned zero bytes (EOF)
Anonymous login successful
(...)

6) The logs show (I'll add a level 10 debug to this ticket):
[2004/11/01 15:36:52, 0] lib/substitute.c:alloc_sub_basic(507)
  alloc_sub_basic: NULL source string!  This should not happen
[2004/11/01 15:36:52, 0] lib/fault.c:fault_report(36)
  ===============================================================
[2004/11/01 15:36:52, 0] lib/fault.c:fault_report(37)
  INTERNAL ERROR: Signal 11 in pid 22468 (3.0.8pre2)
  Please read the appendix Bugs of the Samba HOWTO collection
[2004/11/01 15:36:52, 0] lib/fault.c:fault_report(39)
  ===============================================================
[2004/11/01 15:36:52, 0] lib/util.c:smb_panic2(1403)
  PANIC: internal error
[2004/11/01 15:36:52, 0] lib/util.c:smb_panic2(1411)
  BACKTRACE: 14 stack frames:
   #0 smbd(smb_panic2+0x7c) [0x81e165c]
   #1 smbd(smb_panic+0x1a) [0x81e185a]
   #2 smbd [0x81ce458]
   #3 [0xffffe420]
   #4 smbd(push_ascii_fstring+0x2a) [0x81cc4fa]
   #5 smbd [0x80910d2]
   #6 smbd(api_reply+0x23a) [0x8095e7a]
   #7 smbd(reply_trans+0x5f4) [0x808cc44]
   #8 smbd [0x80d3844]
   #9 smbd(process_smb+0x16a) [0x80d3c2a]
   #10 smbd(smbd_process+0x145) [0x80d4915]
   #11 smbd(main+0x4e7) [0x8257fe7]
   #12 /lib/tls/libc.so.6(__libc_start_main+0xe0) [0xb7c23e20]
   #13 smbd [0x80786d1]