I looked quickly at Rob's bug. It's a problem in relaxng and while I'm
surprized it ain't caught by the existing regression tests, seems fairly
contained. I though I had a patch ready but I was wrong. I need a bit of testing
but it should be fixeable easilly. I don't think it's directly related to
the streaming. The bug seems to be in xmlRelaxNGSchemaTypeCompare() when
there is an error, we free the base value passed from the to, which then
crash when we free the RNG schemas later. That should be relatively easy
to fix...