YES! I finally managed to fix this elusive memory corruption bug, that 
showed up on a couple of Solaris and HPUX builds.
Akiumi Hasegawa graciously provided an account on his machine for me
to debug this -- Thanks Aki!
The problem was that we didn't allocate enough space for the argv[]
array used for run_temacs -- somebody forgot about the trailing 0.
This bug must have been there for AGES! It showed up so seldomly
because DO_REALLOC doubles the existing size. In this case it will
only show up when nargs=2^n-1.
This also proves that all good bug-fixes are one-liners. :-)
The patch is against the 21.2.13 release. This is definitely
recommended for 21.1
  Gunnar
1999-05-11  Gunnar Evermann  <ge204(a)eng.cam.ac.uk>
	* emacs.c (Frun_emacs_from_temacs): (re)alloc natgs+2 entries for
	run_temacs_argv array -- fixes random memory corruption crash
Index: src/emacs.c
===================================================================
RCS file: /usr/CVSroot/XEmacs/xemacs/src/emacs.c,v
retrieving revision 1.82.2.10
diff -u -r1.82.2.10 emacs.c
--- emacs.c	1999/03/03 16:38:47	1.82.2.10
+++ emacs.c	1999/05/11 21:40:36
@@ -2014,7 +2014,7 @@
       total_len += wampum_all_len[ac];
     }
   DO_REALLOC (run_temacs_args, run_temacs_args_size, total_len, char);
-  DO_REALLOC (run_temacs_argv, run_temacs_argv_size, nargs+1, char *);
+  DO_REALLOC (run_temacs_argv, run_temacs_argv_size, nargs+2, char *);
 
   memcpy (run_temacs_args, wampum, namesize);
   run_temacs_argv [0] = run_temacs_args;