Reported a couple weeks ago by Thomas Koenig on the Debian BTS. He's using Debian's Xserver 1.3 which has been built on top of some snapshot of the Mesa 7.0 branch (I'd say near 7.0.1 but I can't be sure right now, sorry, I'll try to get more details).

He says:
  Run xscreensaver-demo, select "Sproingies", click "Preview".
  Seems like the heavy 3d activity crashes the system.

His config and log are available at the URL above.

Here's the gdb backtrace:

Core was generated by `/usr/bin/X -br -nolisten tcp :0 vt7 -auth /var/run/xauth/A:0-pXirMN'.
Program terminated with signal 11, Segmentation fault.
#0  0xb6327661 in _mesa_DrawBuffer (buffer=1029) at buffers.c:350
350	buffers.c: No such file or directory.
	in buffers.c
(gdb) bt full
#0  0xb6327661 in _mesa_DrawBuffer (buffer=1029) at buffers.c:350
	bufferID = <value optimized out>
	destMask = <value optimized out>
	ctx = (GLcontext *) 0x850dfb0
#1  0xb7bf4928 in __glXDisp_DrawBuffer (pc=0x8a9f74c "\005\004")
    at ../../../GL/glx/indirect_dispatch.c:1329
No locals.
#2  0xb7bed595 in DoRender (cl=0x850d640, pc=0x8a9f748 "\b", do_swap=0)
    at ../../../GL/glx/glxcmds.c:1824
	entry = {bytes = 8, varsize = 0}
	extra = <value optimized out>
	proc = (__GLXdispatchRenderProcPtr) 0xb7bf4900 <__glXDisp_DrawBuffer>
	err = 0
	client = (ClientPtr) 0x8546158
	left = 8
	cmdlen = 8
	error = <value optimized out>
	commandsDone = 0
	glxc = (__GLXcontext *) 0x8546010
	sw = <value optimized out>
#3  0xb7bed62c in __glXDisp_Render (cl=0x850d640, pc=0x8a9f740 "\217\001\004")
    at ../../../GL/glx/glxcmds.c:1838
No locals.
#4  0xb7bf1a7c in __glXDispatch (client=0x8546158)
    at ../../../GL/glx/glxext.c:551
	stuff = (xGLXSingleReq *) 0x8a9f740
	opcode = 1 '\001'
	proc = (__GLXdispatchSingleProcPtr) 0xb7bed600 <__glXDisp_Render>
	cl = (__GLXclientState *) 0x850d640
	retval = 1
#5  0x08154a3e in ?? ()
No symbol table info available.
#6  0x08546158 in ?? ()
No symbol table info available.
#7  0x08546158 in ?? ()
No symbol table info available.
#8  0x08223ed0 in ?? ()
No symbol table info available.
#9  0x081e3b7c in ?? ()
No symbol table info available.
#10 0x00000000 in ?? ()
No symbol table info available.