Any suggestions on how I can find out in this coredump where the original exception was? (i.e. which pike file and linenumber point at the spot where we tried to access the variable in the destructed object).
You didn't get a backtrace from debug_va_fatal()?
As far as I can see, the access to a variable in a destructed object was from the error handling code (usually master()->handle_error()).
If you are able to trigger the bug again, I would recomend running it in gdb and doing a
(gdb) call gdb_backtraces()
when the abort is triggered.
Another approach could be to alter error.c:debug_va_fatal() to call gdb_backtraces() when/if it fails to render a backtrace. I've now modified it accordingly in Pike master.
/grubba