I can now confirm that I've been running three hours with io->this = 0 at destruct, and there have not been any coredumps yet. Seems promising.
I'm still a bit surprised by the premise that a CMODs PIKEFUNs would be entered in/with an object *after* it has been destructed... you guard function entry, so this is apparently not a case of our object getting destructed while we are already executing.
I would think that this is simply not supposed to happen (and that therefore fixing it at this level is the wrong thing to do).
Grubba, do you have any thoughts about PIKEFUNs being entered in destructed objects?