A bit of further debugging shows that it's segfaulting at this instruction

  103a26:    80 7e 0c 09              cmpb   $0x9,0xc(%rsi)
[download]

presumably because register rsi (+ offset 0xc) is pointing to some junk address.  AFAICT, this instruction is supposed to check some part of the thread context (whatever the macro pTHX_ expands to) - i.e. a value on the stack.

My guess would be that the calling routine has left rsi and/or the stack in an inconsistent state (due to some bug while handling the unexpected tell parameter?)... but I haven't checked this any further, yet.