Segmentation fault when a Ruby method is invoked by a C method via Object#send

How it was found

We can arrange for C to call Object#send by aliasing it over initialize. This will cause Class#new (a C function) to call #initialize (which is actually Object#send) with arbitrary arguments.

If we invoke a Ruby method through Object#send, mruby segfaults:

def foo
end

class X
  alias_method :initialize, :send
end

X.new.send(:foo)