$ printf 'foo\nfoo\nfoo\n' > foo
	$ /usr/bin/ex foo
	foo: unmodified: line 3
	:g/foo/vi

At this point you're in visual mode, on the first match for foo in the
file, but there's still the global search running, as on each match you
enter into visual mode. Usually one uses "Q" to advance through the
matches until there are no more matches and you go back to the ex
command prompt. The crash (may) happen if you enter ":q!" while the
global search is running and then (sometimes)

	:q!
	Flag offset to before line 1
	ex(86105) in free(): write to free mem 0x10d52459180[0..7]@192
	Abort trap (core dumped) 

This may also happen in nvi (use "Q" to get over to ex mode to start the
"global /foo/ visual" ex command, if you started in visual mode) so the
crash is portable to that code, unless it's already been fixed upstream.

	:q!
	nvi(12274) in free(): write to free mem 0x40940c52a00[232..239]@256
	Abort trap (core dumped)