Its quite simple to reproduce on Windows using the GDI driver (did not test the gallium driver but it should suffer fom the same problem):

initialization:

HGLRC rc_to_share = wglCreateContext( hDC );
HGLRC rc_2 = wglCreateContext( hDC );
wglShareLists(rc_to_share, rc_2);

rendering:

glBegin( GL_TRIANGLES );
=> CRASH

The reason seems to be a bug in the _mesa_share_state implementation. This points the rc_2 context's "Shared" attribut to the "Shared" instance of rc_to_share. It then realizes that the old "Shared" instance of rc_2 has a refCount of 0 and deletes the associated memory. Unfortunately the GLcontext rc_2 has some attributes that still point to the just freed memory. 

When calling glBegin the application "crashes" due to an assert in vbo_exec_vtx_map. There you will find that vbo_exec_context::vtx::bufferobj still points to GLcontext::Shared->NullBufferObj BUT not of the rc_to_share context but of the rc_2 context. In other words the bufferobj in the vbo_exec_context does still point to the memory location that has been freed. It should point to the memory location of the rc_to_share's Shared::NullBufferObj. 

I cannot tell if other attributes of those structures are concerned but obviously the _mesa_share_state function does only take care of the gl_shared_state contents and it does NOT adjust other structure's field that point to the same addresses as the (then freed) pointers in gl_shared_state. So there might be more problems around the corner which I have not investigated.

As a small workaround to share contexts on Windows I have added my own function to the GDI driver. The _mesa_initialize_context function (internally used by wglCreateContext via WMesaCreateContext) already has a parameter share_lists so I wrote a function myWglCreateSharingContext (HDC, HDLRC) to feed this parameter. Apart from the its implementation is the same as wglCreateContext(HDC). 

This workaround works without any problems which leads to the assumption that only the sharing between two existing contexts is concerned. Creating a new context as a sharing context right from the start (as you usually do on X11) does not suffer from problems.