I managed to crash the (latest) cog VM consistently, producing the attached crash dump (containing two crashes).
Debugging the code carefully I found that somewhere in the process of setting an instance variable of an object at the top of a tree-like structure, by traversing the tree downwards and back (lazy initializing instance variables), a clearly wrong method was executed:
setCenter: aPoint
center := center
after correcting this the crashes didn't occur anymore.
Not sure how important this is, but surprising it was, though!
Hans