Running 'show' in the global allocation mode while the current font is local, can cause a garbager crash due to gx_show_enum refers to current font.
This problem is similar to Bug 688140 "A heap corruption in imagemask", Bug 688145 "Segmentation fault : normal 244-01.ps (pkmraw/300/noband)"
Related structure descriptors : st_pnga_text_enum st_gs_show_enum st_gs_text_enum
Bug still reproducible in Ghostscript 9.03
Git commit 0816e3b87ec1843a31e3075a4fa382e844a46158, patch here: http://ghostscript.com/pipermail/gs-cvs/2012-February/014164.html should resolve this issue, though since there is no specimen file or reproduction method its impossible to tell for certain. This alters the PostScript operators so that st_gs_show_enum structures are always allocated from local VM. I cannot find any mention of st_pnga_text_enum structures, if they ever existed they have gone now. st_gs_text_enum structures are only allocated from the trace device, and as far as I can tell use the VM mode supplied by the operator, so this will also always be in local VM now.