lines. The crash happens as you describe if there are at least 9 lines in history; if there are exactly 8, then pressing up won't crash, but pressing down afterward will.
Don't know if that helps at all or not.
It did!
The code crashed if you had 8..15, 24..31, 40..48 etc (when num_entries&8 == 8) history entries in your .hilfe_history.
So, basically, 50% probability or so. :)
Anyway, the code accidentally checked if (value&8) was 8 instead of if (type&8) was 8 before doing a refs++.