Crash on Linux setting a sequence of rally points

[vts]

halcyonXIII encountered a crash when setting a sequence of rally points for a structure, using svn rev. 11951.

Steps to reproduce:

1. Select a building which can produce or garrison units.
2. Hold down the Shift key, and set a chain of rally points anywhere.
3. Usually on about the 5th rally point, 0AD crashes.

Occasionally, the crash produces this log:

Function call failed: return value was -120000 (Handle index completely out of bounds)
Location: h_mgr.cpp:197 (h_data_from_idx)

Call stack:

(0x7f4caa) ./pyrogenesis() [0x7f4caa]
(0x79fc11) ./pyrogenesis() [0x79fc11]
(0x7a08ee) ./pyrogenesis() [0x7a08ee]
(0x7a00e9) ./pyrogenesis() [0x7a00e9]
(0x7c33f3) ./pyrogenesis() [0x7c33f3]
(0x7cad95) ./pyrogenesis() [0x7cad95]
(0x5e81e4) ./pyrogenesis() [0x5e81e4]
(0x675537) ./pyrogenesis() [0x675537]
(0x65aade) ./pyrogenesis() [0x65aade]
(0x65ad39) ./pyrogenesis() [0x65ad39]
(0x65b62c) ./pyrogenesis() [0x65b62c]
(0x6510c4) ./pyrogenesis() [0x6510c4]
(0x65191f) ./pyrogenesis() [0x65191f]
(0x587fa1) ./pyrogenesis() [0x587fa1]
(0x41d9b3) ./pyrogenesis() [0x41d9b3]
(0x4135d7) ./pyrogenesis() [0x4135d7]

errno = 0 (No error reported here)
OS error = ?

The crash is confirmed to be reproducible on Linux (specifically flavors of Ubuntu), but not on Windows.