Steps I took to reproduce the issue:

- Open Calc
- Select the Sum button and then press the Accept button.
- Press the Function button. The application will crash at this point

Here is the most relevant part of the stack trace I got on Linux PPC:

#0  0x0a03ede4 in EdtAutoCorrDoc::SetINetAttr () from /var/tmp/OOo-m186/program/libsvx680lp.so
#1  0x0a031770 in EditView::GetVisArea () from /var/tmp/OOo-m186/program/libsvx680lp.so
#2  0x0b2f924c in ScEditObjectViewForwarder::LogicToPixel ()
    at /share/Build/OpenOffice.org/m186/solver/680/unxlngppc.pro/inc/com/sun/star/uno/
Reference.h:254
#3  0x0a3394e0 in accessibility::AccessibleStaticTextBase::getSelectionStart () from /var/tmp/OOo-
m186/program/libsvx680lp.so
#4  0x0a32edf8 in accessibility::AccessibleTextHelper::IsSelected () from /var/tmp/OOo-m186/
program/libsvx680lp.so
#5  0x0a32f7c0 in accessibility::AccessibleTextHelper::UpdateChildren () from /var/tmp/OOo-m186/
program/libsvx680lp.so
#6  0x0a330150 in accessibility::AccessibleTextHelper::UpdateChildren () from /var/tmp/OOo-m186/
program/libsvx680lp.so
#7  0x0fbdd3f0 in SfxBroadcaster::Broadcast () from /var/tmp/OOo-m186/program/libsvl680lp.so
#8  0x0b2fc154 in ScAccessibleEditObjectTextData::NotifyHdl ()
    at /share/Build/OpenOffice.org/m186/solver/680/unxlngppc.pro/inc/com/sun/star/uno/
Reference.h:254
#9  0x0a049c0c in EdtAutoCorrDoc::SetINetAttr () from /var/tmp/OOo-m186/program/libsvx680lp.so
#10 0x0a05fef8 in EdtAutoCorrDoc::SetINetAttr () from /var/tmp/OOo-m186/program/libsvx680lp.so
#11 0x0a062a98 in EdtAutoCorrDoc::SetINetAttr () from /var/tmp/OOo-m186/program/libsvx680lp.so
#12 0x0a01ce84 in EditEngine::SetUpdateMode () from /var/tmp/OOo-m186/program/libsvx680lp.so
#13 0x0afe8c8c in ScEditEngineDefaulter::SetText () at /usr/include/c++/4.1/exception:56
#14 0x0ab582e0 in ScTextWnd::SetTextString () from /var/tmp/OOo-m186/program/libsc680lp.so
#15 0x0ab5a1a0 in ScInputWindow::Select () from /var/tmp/OOo-m186/program/libsc680lp.so
#16 0x0febdd78 in ToolBox::Command () from /var/tmp/OOo-m186/program/libvcl680lp.so
#17 0x0febdef8 in ToolBox::Tracking () from /var/tmp/OOo-m186/program/libvcl680lp.so
#18 0x0feed080 in Window::EndTracking () from /var/tmp/OOo-m186/program/libvcl680lp.so
#19 0x0fee8788 in Window::~Window () from /var/tmp/OOo-m186/program/libvcl680lp.so
#20 0x0fee93cc in Window::~Window () from /var/tmp/OOo-m186/program/libvcl680lp.so
#21 0x0dc08b28 in GtkSalFrame::signalButton () from /var/tmp/OOo-m186/program/
libvclplug_gtk680lp.so