I've checked a simple configuration (global instance of chain overlay; request for non existing entry, resulting in slapd returning the default referral), and nothing strange appeared (the offending instruction is executed). The issue might be specific to your configuration. You'll probably need to post more details.

I've checked a "real" case: DNSSRV-located DSAs, one responding and one not. Things seem to work as expected, no cores and valgrind shows no issue. In any case, I have committed a few modifications to HEAD code (plugs a potential leak). Please test and either provide more details about the core or more details about the configuration.

p.