I didn't witness a freeze, but I opened emacs -Q, did M-: #[] twice,
moved point around without a problem, then did C-x 3 and Emacs core
dumped.

Core was generated by `emacs --reverse-video -Q'.
Program terminated with signal 11, Segmentation fault.
#0  0x00000031cfc0e7fd in raise () from /lib64/libpthread.so.0
(gdb) bt
#0  0x00000031cfc0e7fd in raise () from /lib64/libpthread.so.0
#1  0x00000000004d0e35 in terminate_due_to_signal (sig=11,
backtrace_limit=40) at emacs.c:369
#2  0x00000000004ea6fe in handle_fatal_signal (sig=11227) at sysdep.c:1626
#3  0x00000000004eaab3 in deliver_thread_signal (sig=11) at sysdep.c:1600
#4  deliver_fatal_thread_signal (sig=11) at sysdep.c:1638
#5  <signal handler called>
#6  0x0000000000554a72 in AREF (f=0x11093b0, spec=11925893) at lisp.h:1170
#7  font_delete_unmatched (f=0x11093b0, spec=11925893) at font.c:2624
#8  font_list_entities (f=0x11093b0, spec=11925893) at font.c:2747
#9  0x0000000000558574 in font_find_for_lface (f=0x11093b0,
attrs=0x7fff12382d00, spec=11845218, c=-1) at font.c:3206
#10 0x0000000000558a6b in font_load_for_lface (f=0x8091c5, attrs=0xb8c2f2,
spec=8425920) at font.c:3276
#11 0x00000000004a1882 in realize_x_face (cache=0xd8eb80,
attrs=0x7fff12382d00, former_face_id=<value optimized out>) at xfaces.c:5529
#12 realize_face (cache=0xd8eb80, attrs=0x7fff12382d00,
former_face_id=<value optimized out>) at xfaces.c:5422
#13 0x00000000004a2661 in lookup_face (f=<value optimized out>,
attr=0x7fff12382d00) at xfaces.c:4411
#14 0x00000000004a36b1 in face_at_string_position (w=<value optimized out>,
string=<value optimized out>, pos=<value optimized out>, bufpos=0,
region_beg=-1, region_end=-1, endptr=0x7fff12382e10,
    base_face_id=MODE_LINE_INACTIVE_FACE_ID, mouse_p=0) at xfaces.c:6194
#15 0x000000000044688c in display_string (string=0xb533e8 "*scratch*",
lisp_string=11874225, face_string=15529169, face_string_pos=1, start=<value
optimized out>, it=0x7fff12383050, field_width=12, precision=-8,
    max_x=<value optimized out>, multibyte=0) at xdisp.c:22278
#16 0x0000000000446f3c in display_mode_element (it=0x7fff12383050, depth=4,
field_width=0, precision=-8, elt=<value optimized out>, props=11845218,
risky=0) at xdisp.c:21031
#17 0x0000000000447570 in display_mode_element (it=0x7fff12383050, depth=3,
field_width=0, precision=-8, elt=<value optimized out>, props=11845218,
risky=0) at xdisp.c:21203
#18 0x0000000000447570 in display_mode_element (it=0x7fff12383050, depth=1,
field_width=0, precision=0, elt=<value optimized out>, props=11845218,
risky=0) at xdisp.c:21203
#19 0x0000000000447e44 in display_mode_line (w=<value optimized out>,
face_id=MODE_LINE_INACTIVE_FACE_ID, format=15394390) at xdisp.c:20720
#20 0x0000000000448120 in display_mode_lines (w=0x1140870) at xdisp.c:20665
#21 0x0000000000453710 in redisplay_window (window=18090101,
just_this_one_p=0) at xdisp.c:16104
#22 0x0000000000456ad6 in redisplay_window_0 (window=8425925) at
xdisp.c:13800
#23 0x0000000000541e33 in internal_condition_case_1 (bfun=0x456ab0
<redisplay_window_0>, arg=18090101, handlers=12055734, hfun=0x425e60
<redisplay_window_error>) at eval.c:1376
#24 0x000000000043275d in redisplay_windows (window=12108530) at
xdisp.c:13780
#25 0x0000000000432724 in redisplay_windows (window=12108530) at
xdisp.c:13774
#26 0x00000000004579ca in redisplay_internal () at xdisp.c:13393
#27 0x00000000004debaa in read_char (commandflag=1, map=20004342,
prev_event=11845218, used_mouse_menu=0x7fff123894ef, end_time=0x0) at
keyboard.c:2551
#28 0x00000000004e0381 in read_key_sequence (keybuf=0x7fff12389550,
bufsize=30, prompt=11845218, dont_downcase_last=false,
can_return_switch_frame=true, fix_current_buffer=true) at keyboard.c:9057
#29 0x00000000004e1fc7 in command_loop_1 () at keyboard.c:1434
#30 0x0000000000541cde in internal_condition_case (bfun=0x4e1d40
<command_loop_1>, handlers=11904962, hfun=0x4d9110 <cmd_error>) at
eval.c:1339
#31 0x00000000004d929a in command_loop_2 (ignore=<value optimized out>) at
keyboard.c:1161
#32 0x0000000000541b9b in internal_catch (tag=<value optimized out>,
func=0x4d9280 <command_loop_2>, arg=11845218) at eval.c:1113
#33 0x00000000004d8660 in command_loop () at keyboard.c:1140
#34 recursive_edit_1 () at keyboard.c:779
#35 0x00000000004d9f86 in Frecursive_edit () at keyboard.c:843
#36 0x00000000004d1b0d in main (argc=<value optimized out>,
argv=0x7fff12389b28) at emacs.c:1570
(gdb)

This was a build of commit d6daa95f46bf36fc4428b511040d97153a6f8dab of
the Savannah Git repo, dated Aug 30.