I managed to crash the (latest) cog VM consistently, producing the attached crash dump (containing two crashes).
Debugging the code carefully I found that somewhere in the process of setting an instance variable of an object at the top of a tree-like structure, by traversing the tree downwards and back (lazy initializing instance variables), a clearly wrong method was executed:

setCenter: aPoint
	
	center := center


after correcting this the crashes didn't occur anymore. 
Not sure how important this is, but surprising it was, though!

Hans
-------------- next part --------------
A non-text attachment was scrubbed...
Name: crash.dmp
Type: application/octet-stream
Size: 52048 bytes
Desc: crash.dmp
Url : http://lists.squeakfoundation.org/pipermail/squeak-dev/attachments/20111117/7e0ab187/crash.obj