It's possible to reliably segfault Emacs when using undercover, at least on Travis: https://github.com/Wilfred/elisp-def/commit/57523ad268e0f4d2550386d45d55d7a6ed5fe50c Not sure why at this point.