Logged In: YES 
user_id=33168

This doesn't crash for me on 2.5 (CVS) (2.4 seems about the
same), but there is use of uninitialized memory in valgrind.
 (It does crash when running under valgrind.)  Either way,
there is still a problem.

Do you still see the crash?

==26881== Use of uninitialised value of size 8
==26881==    at 0x12BA4518: normal_updatePosition
(xmltok_impl.c:1745)
==26881==    by 0x12B91005: XML_GetCurrentLineNumber
(xmlparse.c:1782)
==26881==    by 0x12B884EA: set_error (pyexpat.c:125)
==26881==    by 0x12B8BCCD: get_parse_result (pyexpat.c:901)
==26881==    by 0x12B8BD6A: xmlparse_Parse (pyexpat.c:923)
==26881==    by 0x4E00B0: PyCFunction_Call (methodobject.c:73)
==26881==    by 0x48B2F3: call_function (ceval.c:3580)
==26881==    by 0x486F4C: PyEval_EvalFrameEx (ceval.c:2181)
==26881==    by 0x48932B: PyEval_EvalCodeEx (ceval.c:2754)
==26881==    by 0x48B76E: fast_function (ceval.c:3673)
==26881==    by 0x48B436: call_function (ceval.c:3601)
==26881==    by 0x486F4C: PyEval_EvalFrameEx (ceval.c:2181)
==26881==    by 0x48932B: PyEval_EvalCodeEx (ceval.c:2754)
==26881==    by 0x4DF7FA: function_call (funcobject.c:548)
==26881==    by 0x418DE2: PyObject_Call (abstract.c:1777)
==26881==
==26881== Invalid read of size 1
==26881==    at 0x12BA4514: normal_updatePosition
(xmltok_impl.c:1745)
==26881==    by 0x12B91005: XML_GetCurrentLineNumber
(xmlparse.c:1782)
==26881==    by 0x12B884EA: set_error (pyexpat.c:125)
==26881==    by 0x12B8BCCD: get_parse_result (pyexpat.c:901)
==26881==    by 0x12B8BD6A: xmlparse_Parse (pyexpat.c:923)
==26881==    by 0x4E00B0: PyCFunction_Call (methodobject.c:73)
==26881==    by 0x48B2F3: call_function (ceval.c:3580)
==26881==    by 0x486F4C: PyEval_EvalFrameEx (ceval.c:2181)
==26881==    by 0x48932B: PyEval_EvalCodeEx (ceval.c:2754)
==26881==    by 0x48B76E: fast_function (ceval.c:3673)
==26881==    by 0x48B436: call_function (ceval.c:3601)
==26881==    by 0x486F4C: PyEval_EvalFrameEx (ceval.c:2181)
==26881==    by 0x48932B: PyEval_EvalCodeEx (ceval.c:2754)
==26881==    by 0x4DF7FA: function_call (funcobject.c:548)
==26881==    by 0x418DE2: PyObject_Call (abstract.c:1777)
==26881==  Address 0x12B720C0 is 0 bytes after a block of
size 131072 alloc'd
==26881==    at 0x11B19F13: malloc (vg_replace_malloc.c:149)
==26881==    by 0x12B90AB5: XML_GetBuffer (xmlparse.c:1634)
==26881==    by 0x12B906B0: XML_Parse (xmlparse.c:1528)
==26881==    by 0x12B8BD5F: xmlparse_Parse (pyexpat.c:923)
==26881==    by 0x4E00B0: PyCFunction_Call (methodobject.c:73)
==26881==    by 0x48B2F3: call_function (ceval.c:3580)
==26881==    by 0x486F4C: PyEval_EvalFrameEx (ceval.c:2181)
==26881==    by 0x48932B: PyEval_EvalCodeEx (ceval.c:2754)
==26881==    by 0x48B76E: fast_function (ceval.c:3673)
==26881==    by 0x48B436: call_function (ceval.c:3601)
==26881==    by 0x486F4C: PyEval_EvalFrameEx (ceval.c:2181)
==26881==    by 0x48932B: PyEval_EvalCodeEx (ceval.c:2754)
==26881==    by 0x4DF7FA: function_call (funcobject.c:548)
==26881==    by 0x418DE2: PyObject_Call (abstract.c:1777)
==26881==    by 0x421034: instancemethod_call
(classobject.c:2447)