[wmii] BUG: write "send sel 3", then "send sel 2" -> crash

Hi,

I've just discovered another bug:
1) Start wmii
2) Open a terminal (Mod1-Return), open another terminal
3) Use wmiir xwrite /tag/sel/ctl send sel 3
4) Use wmiir xwrite /tag/sel/ctl send sel 2
5) wmii crashes.

GDB backtrace:

Program terminated with signal 11, Segmentation fault.
#0 0x0804b54c in area_idx (a=0x80b3f08) at area.c:26
26 for(ap=v->areas[a->screen]; a != ap; ap=ap->next)
(gdb) bt
#0 0x0804b54c in area_idx (a=0x80b3f08) at area.c:26
#1 0x080502c9 in column_insert (a=0x80b3f08, f=0x80aa418, pos=0x0) at column.c:102
#2 0x08050954 in column_attach (a=0x80b3f08, f=0x80aa418) at column.c:258
#3 0x0804becc in area_attach (a=0x80b3f08, f=0x80aa418) at area.c:243
#4 0x0804bdff in area_moveto (to=0x80b3f08, f=0x80aa418) at area.c:216
#5 0x0805f38d in msg_sendclient (v=0x8094570, m=0xbfcb4d98, swap=false) at message.c:1029
#6 0x0805e1da in message_view (v=0x8094570, m=0xbfcb4d98) at message.c:639
#7 0x0806de4d in ixp_srv_writectl (r=0x80b4520, fn=0x805e07a <message_view>) at srv_util.c:162
#8 0x08058b39 in fs_write (r=0x80b4520) at fs.c:562
#9 0x0806cd8c in handlereq (r=0x80b4520) at request.c:311
#10 0x0806c5b5 in handlefcall (c=0x80b3c88) at request.c:137
#11 0x0806d8b5 in handle_conns (s=0x80810a0) at server.c:113
#12 0x0806d9e6 in ixp_serverloop (s=0x80810a0) at server.c:161
#13 0x0805cc04 in main (argc=0, argv=0xbfcb5200) at main.c:424

Let me know if you need more information (and what, precisely) on this.

Best regards,
Michael