The builtin http support (-Q) double free's (or otherwise corrupts) url (I think) in
feh_http_load_image()
(I'm assuming double free based on the error, and the hard-to-track error paths through there.
I'm assuming it's url getting nobbled because of it's highly improbably value in the trace, but validity when passed in in the non-builtin case).
% src/feh -QV http://images.slashdot.org/knobs.gif
*** glibc detected *** double free or corruption (fasttop): 0x080747b0 ***
zsh: abort (core dumped) src/feh -QV http://images.slashdot.org/knobs.gif
(gdb) where
#0 0xb7c4b9e7 in raise () from /lib/tls/libc.so.6
#1 0xb7c4d31b in abort () from /lib/tls/libc.so.6
#2 0xb7c82365 in __fsetlocking () from /lib/tls/libc.so.6
#3 0xb7c88a07 in malloc_usable_size () from /lib/tls/libc.so.6
#4 0xb7c88ea2 in free () from /lib/tls/libc.so.6
#5 0x08055710 in feh_http_load_image (url=0x4 <Address 0x4 out of bounds>)
at imlib.c:574
#6 0x0805502b in feh_load_image (im=0x807470c, file=0x806f0c0) at imlib.c:139
#7 0x0804e02a in winwidget_create_from_file (list=0x806f118,
name=0x80746a0 "feh [1 of 1] - http://images.slashdot.org/knobs.gif",
type=1 '\001') at winwidget.c:135
#8 0x08058c97 in init_slideshow_mode () at slideshow.c:64
#9 0x0804c889 in main (argc=0, argv=0x0) at main.c:83
