michael.cahill says:

To clarify, what I was trying to say is that we have seen various failures when running LSM with read-uncommitted isolation that suggest that the oldest transaction ID is not being pinned correctly during a read. That has been detected as read-after-free by address sanitizer, and I guess could conceivably lead to memory corruption, though I can't see a direct path that explains this bug.