as reported by Bertrand Jacquin, this crashes:
$ date -d 'TZ="America/Los_Angeles" "00:00 + 1 hour"'
Segmentation fault

(gdb) bt
#0  0x00007ffff7ab1014 in __GI___libc_free (mem=0x7fffffffc8b0) at malloc.c:2942
#1  0x0000000000406730 in parse_datetime (result=result@entry=0x7fffffffcab0, p=<optimized out>, p@entry=0x7fffffffd04a "TZ=\"America/Los_Angeles\" \"00:00 + 1 hour\"", now=<optimized out>, now
@entry=0x0) at ./lib/parse-datetime.y:1307
#2  0x00000000004023c7 in main (argc=0x3, argv=0x7fffffffcc68) at src/date.c:522

that's 15fca2a02e38d69915c52ef41eee3c7d52b67f3e i happened to have already
built, but seems to reproduce easily across older versions.
-mike