I was continuing the bug tracking and this is what I founded.
movl %eax,0x4c(%esp) call 0x84(%eax) -- command causing the crash
x /92x $eax will display this ... (DDRAW.DLL.EntryPoint+0xc320 in libddraw.so): 406cd010 dead001e 406cd3a0 406cd420
So. address 0x84(eax) contains 0xdead001e there should be usable address to some function.
What is the name of missing function ?
it appears that backtrace was showing incorrect information ??
Jarmo