I've done some further work on the problem, and it appears that the "pullup" filter is 100% at-fault. Using ivtc solves the problem. Has anyone been coding on pullup lately ;-) Although, I don't think mplayer should crash like this, even with a corrupt video.