Confirmed on LibO 3.6.0 rc1.

backtrace is here:

#0  0x00007ffff7188694 in ?? () from /lib/x86_64-linux-gnu/libc.so.6
#1  0x00007fffc14fe126 in ?? () from /opt/libreoffice3.6/program/../program/libswlo.so
#2  0x00007fffc150266a in ?? () from /opt/libreoffice3.6/program/../program/libswlo.so
#3  0x00007ffff53f9275 in SfxListUndoAction::RedoWithContext(SfxUndoContext&) ()
   from /opt/libreoffice3.6/program/libsvllo.so
#4  0x00007ffff53fc837 in SfxUndoManager::ImplRedo(SfxUndoContext*) () from /opt/libreoffice3.6/program/libsvllo.so
#5  0x00007ffff53fca29 in SfxUndoManager::RedoWithContext(SfxUndoContext&) () from /opt/libreoffice3.6/program/libsvllo.so
#6  0x00007fffc14f033e in ?? () from /opt/libreoffice3.6/program/../program/libswlo.so
#7  0x00007fffc14f05fb in ?? () from /opt/libreoffice3.6/program/../program/libswlo.so
#8  0x00007fffc130c898 in SwEditShell::Redo(unsigned short) () from /opt/libreoffice3.6/program/../program/libswlo.so
#9  0x00007fffc19c4713 in SwWrtShell::Do(SwWrtShell::DoType, unsigned short) ()
   from /opt/libreoffice3.6/program/../program/libswlo.so
#10 0x00007fffc18970ef in ?? () from /opt/libreoffice3.6/program/../program/libswlo.so
#11 0x00007ffff5810a42 in ?? () from /opt/libreoffice3.6/program/libsfxlo.so
#12 0x00007ffff580600b in ?? () from /opt/libreoffice3.6/program/libsfxlo.so
#13 0x00007ffff58265f6 in ?? () from /opt/libreoffice3.6/program/libsfxlo.so
#14 0x00007ffff5826e69 in ?? () from /opt/libreoffice3.6/program/libsfxlo.so
#15 0x00007ffff4f3a1a4 in ?? () from /opt/libreoffice3.6/program/libsvtlo.so
#16 0x00007ffff391c55a in ?? () from /opt/libreoffice3.6/program/libvcllo.so
#17 0x00007ffff39caa11 in ?? () from /opt/libreoffice3.6/program/libvcllo.so
#18 0x00007ffff39d4e3e in SalGenericDisplay::DispatchInternalEvent() () from /opt/libreoffice3.6/program/libvcllo.so
---Type <return> to continue, or q <return> to quit---
#19 0x00007fffe9ed2967 in ?? () from /opt/libreoffice3.6/program/libvclplug_gtklo.so
#20 0x00007fffe9ed29d9 in ?? () from /opt/libreoffice3.6/program/libvclplug_gtklo.so
#21 0x00007fffe81f9d53 in g_main_context_dispatch () from /lib/x86_64-linux-gnu/libglib-2.0.so.0
#22 0x00007fffe81fa0a0 in ?? () from /lib/x86_64-linux-gnu/libglib-2.0.so.0
#23 0x00007fffe81fa164 in g_main_context_iteration () from /lib/x86_64-linux-gnu/libglib-2.0.so.0
#24 0x00007fffe9ed2acd in ?? () from /opt/libreoffice3.6/program/libvclplug_gtklo.so
#25 0x00007ffff3709d81 in Application::Yield(bool) () from /opt/libreoffice3.6/program/libvcllo.so
#26 0x00007ffff3709e37 in Application::Execute() () from /opt/libreoffice3.6/program/libvcllo.so
#27 0x00007ffff7922fcd in ?? () from /opt/libreoffice3.6/program/libsofficeapp.so
#28 0x00007ffff3710717 in ?? () from /opt/libreoffice3.6/program/libvcllo.so
#29 0x00007ffff37107e5 in SVMain() () from /opt/libreoffice3.6/program/libvcllo.so
#30 0x00007ffff794eab7 in soffice_main () from /opt/libreoffice3.6/program/libsofficeapp.so
#31 0x000000000040070b in ?? ()
#32 0x00007ffff706476d in __libc_start_main () from /lib/x86_64-linux-gnu/libc.so.6
#33 0x000000000040066a in ?? ()
#34 0x00007fffffffe238 in ?? ()
#35 0x000000000000001c in ?? ()
#36 0x0000000000000001 in ?? ()
#37 0x00007fffffffe503 in ?? ()
#38 0x0000000000000000 in ?? ()

Takeshi Abe committed a patch related to this issue.
It has been pushed to "master":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=7b689371cc344f14af783f87c7fe37f5350c10ab

fdo#52013: Writer will crash when the undo-redoing if it contains dummy text

Caolan McNamara committed a patch related to this issue.
It has been pushed to "master":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=c06fe7e201cdb0fa77da3067dc51a2c6e081d82a

Resolves: fdo#52013 use vector::insert instead

Caolan McNamara committed a patch related to this issue.
It has been pushed to "libreoffice-3-6":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=3669bb966f709089f43111b5ca1057bfe4a22697&g=libreoffice-3-6

Resolves: fdo#52013 use vector::insert instead


It will be available in LibreOffice 3.6.