Thanks anonymonk. That allowed me to track down this (which I apparently missed first time?):

SV *
Perl_newSVsv(pTHX_ register SV *const old)
{
    dVAR;
    register SV *sv;

    if (!old)
    return NULL;
    if (SvTYPE(old) == SVTYPEMASK) {
    Perl_ck_warner_d(aTHX_ packWARN(WARN_INTERNAL), "semi-panic: attem
+pt to dup freed string");
    return NULL;
    }
    new_SV(sv);
    /* SV_GMAGIC is the default for sv_setv()
       SV_NOSTEAL prevents TEMP buffers being, well, stolen, and saves
+ games
       with SvTEMP_off and SvTEMP_on round a call to sv_setsv.  */
    sv_setsv_flags(sv, old, SV_GMAGIC | SV_NOSTEAL);
    return sv;
}
[download]

And also this:

c:\test\perl-5.13.6>findstr SVTYPEMASK *.h
sv.h:#define SVTYPEMASK 0xff
sv.h:#define SvTYPE(sv) ((svtype)((sv)->sv_flags & SVTYPEMASK))
sv.h:#define SvIS_FREED(sv)     ((sv)->sv_flags == SVTYPEMASK)
[download]

Which tends to suggest that when an SV is freed, it's type is set to 0xff to allow duplicate frees to be detected. Though I haven't found the code where that actually happens.

Which probably means I need to implement a DESTROY method. And possible a CLONE method.