I have been able to make this happen on a fairly regular basis using a user defined session handler.. 

You can grap the tarball of the session handler at http://64.81.150.105/session.tar  

System is a Redhat 7.1.  
MySQL Version 3.23.39
Apache Version 1.3.20
PHP version 4.1.2 as a module
configure line: ./configure  --with-mysql --with-apxs=/usr/local/apache/bin/apxs --with-gd

here is the bt:

Starting program: /usr/local/apache/bin/httpd -X

Program received signal SIGSEGV, Segmentation fault.
zend_hash_internal_pointer_reset_ex (ht=0x3, pos=0xbffff080) at zend_hash.c:978
978                     *pos = ht->pListHead;
(gdb) bt
#0  zend_hash_internal_pointer_reset_ex (ht=0x3, pos=0xbffff080) at zend_hash.c:978
#1  0x40267c5f in php_session_save_current_state () at session.c:544
#2  0x4026a1d2 in php_session_flush () at session.c:1381
#3  0x4026a1f7 in zm_deactivate_session (type=1, module_number=3) at session.c:1393
#4  0x40228cdd in module_registry_cleanup (module=0x80d9178) at zend_API.c:1165
#5  0x4022a954 in zend_hash_apply (ht=0x4030f460, apply_func=0x40228cb0 <module_registry_cleanup>) at zend_hash.c:669
#6  0x402258da in zend_deactivate_modules () at zend.c:585
#7  0x402325ff in php_request_shutdown (dummy=0x0) at main.c:723
#8  0x4022fa8c in apache_php_module_main (r=0x80eee4c, display_source_mode=0) at sapi_apache.c:96
#9  0x4023050e in send_php (r=0x80eee4c, display_source_mode=0, filename=0x0) at mod_php4.c:575
#10 0x40230562 in send_parsed_php (r=0x80eee4c) at mod_php4.c:590
#11 0x08054633 in ap_invoke_handler () at eval.c:41
#12 0x08068179 in process_request_internal () at eval.c:41
#13 0x080681dc in ap_process_request () at eval.c:41
#14 0x0805f7ae in child_main () at eval.c:41
#15 0x0805f93c in make_child () at eval.c:41
#16 0x0805fa99 in startup_children () at eval.c:41
#17 0x080600d6 in standalone_main () at eval.c:41
#18 0x08060863 in main () at eval.c:41
#19 0x4008fe5e in __libc_start_main (main=0x806051c <main>, argc=2, ubp_av=0xbffffb0c, init=0x804ead0 <_init>, 
    fini=0x809506c <_fini>, rtld_fini=0x4000d3c4 <_dl_fini>, stack_end=0xbffffb04) at ../sysdeps/generic/libc-start.c:129


Starting program: /usr/local/apache/bin/httpd -X

Program received signal SIGSEGV, Segmentation fault.
zend_hash_get_current_key_ex (ht=0x80fbdbc, str_index=0xbffff074, str_length=0xbffff078, num_index=0xbffff07c, duplicate=0, 
    pos=0xbffff080) at zend_hash.c:1035
1035                    if (p->nKeyLength) {
(gdb) bt
#0  zend_hash_get_current_key_ex (ht=0x80fbdbc, str_index=0xbffff074, str_length=0xbffff078, num_index=0xbffff07c, duplicate=0, 
    pos=0xbffff080) at zend_hash.c:1035
#1  0x40267cb7 in php_session_save_current_state () at session.c:545
#2  0x4026a1d2 in php_session_flush () at session.c:1381
#3  0x4026a1f7 in zm_deactivate_session (type=1, module_number=3) at session.c:1393
#4  0x40228cdd in module_registry_cleanup (module=0x80d8c10) at zend_API.c:1165
#5  0x4022a954 in zend_hash_apply (ht=0x4030f460, apply_func=0x40228cb0 <module_registry_cleanup>) at zend_hash.c:669
#6  0x402258da in zend_deactivate_modules () at zend.c:585
#7  0x402325ff in php_request_shutdown (dummy=0x0) at main.c:723
#8  0x4022fa8c in apache_php_module_main (r=0x80ee8fc, display_source_mode=0) at sapi_apache.c:96
#9  0x4023050e in send_php (r=0x80ee8fc, display_source_mode=0, filename=0x0) at mod_php4.c:575
#10 0x40230562 in send_parsed_php (r=0x80ee8fc) at mod_php4.c:590
#11 0x08054633 in ap_invoke_handler () at eval.c:41
#12 0x08068179 in process_request_internal () at eval.c:41
#13 0x080681dc in ap_process_request () at eval.c:41
#14 0x0805f7ae in child_main () at eval.c:41
#15 0x0805f93c in make_child () at eval.c:41
#16 0x0805fa99 in startup_children () at eval.c:41
#17 0x080600d6 in standalone_main () at eval.c:41
#18 0x08060863 in main () at eval.c:41
#19 0x4008fe5e in __libc_start_main (main=0x806051c <main>, argc=2, ubp_av=0xbffffb0c, init=0x804ead0 <_init>, 
    fini=0x809506c <_fini>, rtld_fini=0x4000d3c4 <_dl_fini>, stack_end=0xbffffb04) at ../sysdeps/generic/libc-start.c:129