Hmm. I wonder if that's the problem -- that his test case had less than two characters. Reading past the end of an array would be a common cause for a seg fault and I can believe that there was a version of bash that failed to check for the front end of the array. Seems unlikely, but possible, especially if there was a different bug that failed to put the right thing in the variable being checked.