Emacs aborts when trying to use replace-string with "bad" character

[Tim Van Holder]

I have a text file that was mangled at some point - the accented
characters have the wrong byte value (e.g. è is \201).  Emacs also
does not recognize this as any particular encoding, so it uses the
\201 notation for the 'bad' characters.
When a replace-string is started, entering \201 (copy-yanked from the
buffer) aborts emacs.

gdb results:

Breakpoint 1, abort () at $HOME/gnu/emacs/src/emacs.c:454
454       kill (getpid (), SIGABRT);
(gdb) up
#1  0x08070660 in set_iterator_to_next (it=0xbfffc4a0, reseat_p=1) at
$HOME/gnu/emacs/src/xdisp.c:5253
5253              xassert (IT_BYTEPOS (*it) == CHAR_TO_BYTE (IT_CHARPOS (*it)));
(gdb) up
#2  0x08070852 in set_iterator_to_next (it=0xbfffc4a0, reseat_p=1) at
$HOME/gnu/emacs/src/xdisp.c:5309
5309                  set_iterator_to_next (it, reseat_p);
(gdb) up
#3  0x08071b23 in move_it_in_display_line_to (it=0xbfffc4a0,
to_charpos=24, to_x=-1, op=8) at $HOME/gnu/emacs/src/xdisp.c:6008
6008          set_iterator_to_next (it, 1);
(gdb) up
#4  0x08071f1d in move_it_to (it=0xbfffc4a0, to_charpos=24, to_x=-1,
to_y=-1, to_vpos=-1, op=8)
    at $HOME/gnu/emacs/src/xdisp.c:6179
6179            skip = move_it_in_display_line_to (it, to_charpos, -1,
MOVE_TO_POS);
(gdb) bt
#0  abort () at $HOME/gnu/emacs/src/emacs.c:454
#1  0x08070660 in set_iterator_to_next (it=0xbfffc4a0, reseat_p=1) at
$HOME/gnu/emacs/src/xdisp.c:5253
#2  0x08070852 in set_iterator_to_next (it=0xbfffc4a0, reseat_p=1) at
$HOME/gnu/emacs/src/xdisp.c:5309
#3  0x08071b23 in move_it_in_display_line_to (it=0xbfffc4a0,
to_charpos=24, to_x=-1, op=8) at $HOME/gnu/emacs/src/xdisp.c:6008
#4  0x08071f1d in move_it_to (it=0xbfffc4a0, to_charpos=24, to_x=-1,
to_y=-1, to_vpos=-1, op=8)
    at $HOME/gnu/emacs/src/xdisp.c:6179
#5  0x08074bc1 in resize_mini_window (w=0x85aef98, exact_p=0) at
$HOME/gnu/emacs/src/xdisp.c:7603
#6  0x08078e7e in redisplay_internal (preserve_echo_area=0) at
$HOME/gnu/emacs/src/xdisp.c:10083
#7  0x08077d73 in redisplay () at $HOME/gnu/emacs/src/xdisp.c:9609
#8  0x0811be9f in read_char (commandflag=1, nmaps=2, maps=0xbfffcee0,
prev_event=137731209, used_mouse_menu=0xbfffcfdc)
    at $HOME/gnu/emacs/src/keyboard.c:2540
#9  0x08125725 in read_key_sequence (keybuf=0xbfffd140, bufsize=30,
prompt=137731209, dont_downcase_last=0,
    can_return_switch_frame=1, fix_current_buffer=1) at
$HOME/gnu/emacs/src/keyboard.c:8799
#10 0x08119818 in command_loop_1 () at $HOME/gnu/emacs/src/keyboard.c:1534
#11 0x08192bdd in internal_condition_case (bfun=0x8119479
<command_loop_1>, handlers=137792201, hfun=0x8118fb6 <cmd_error>)
    at $HOME/gnu/emacs/src/eval.c:1385
#12 0x081192fb in command_loop_2 () at $HOME/gnu/emacs/src/keyboard.c:1315
#13 0x081926bc in internal_catch (tag=137815633, func=0x81192d8
<command_loop_2>, arg=137731209)
    at $HOME/gnu/emacs/src/eval.c:1144
#14 0x0811925b in command_loop () at $HOME/gnu/emacs/src/keyboard.c:1282
#15 0x08118d38 in recursive_edit_1 () at $HOME/gnu/emacs/src/keyboard.c:987
#16 0x0814619b in read_minibuf (map=137760173, initial=137731209,
prompt=142784411, backup_n=137731209, expflag=0,
    histvar=139968233, histpos=0, defalt=142784331, allow_props=0,
inherit_input_method=1, keep_all=1)
    at $HOME/gnu/emacs/src/minibuf.c:700
#17 0x08146973 in Fread_from_minibuffer (prompt=142784411,
initial_contents=137731209, keymap=137760173, read=137731209,
    hist=139968233, default_value=142784331,
inherit_input_method=137731257, keep_all=137731257)
    at $HOME/gnu/emacs/src/minibuf.c:987
#18 0x08194f76 in Ffuncall (nargs=9, args=0xbfffd644) at
$HOME/gnu/emacs/src/eval.c:2813
#19 0x081c95db in Fbyte_code (bytestr=137285075, vector=137285116,
maxdepth=80) at $HOME/gnu/emacs/src/bytecode.c:686
#20 0x08195597 in funcall_lambda (fun=137285020, nargs=3,
arg_vector=0xbfffd854) at $HOME/gnu/emacs/src/eval.c:2967
#21 0x08194fbe in Ffuncall (nargs=4, args=0xbfffd850) at
$HOME/gnu/emacs/src/eval.c:2828
#22 0x081c95db in Fbyte_code (bytestr=137285299, vector=137285356,
maxdepth=40) at $HOME/gnu/emacs/src/bytecode.c:686
#23 0x08195597 in funcall_lambda (fun=137285244, nargs=2,
arg_vector=0xbfffd9c0) at $HOME/gnu/emacs/src/eval.c:2967
#24 0x081951f5 in apply_lambda (fun=137285244, args=137288661,
eval_flag=1) at $HOME/gnu/emacs/src/eval.c:2889
#25 0x081941d9 in Feval (form=137288653) at $HOME/gnu/emacs/src/eval.c:2172
#26 0x08192283 in Flet (args=137288621) at $HOME/gnu/emacs/src/eval.c:970
#27 0x08193dec in Feval (form=137288613) at $HOME/gnu/emacs/src/eval.c:2077
#28 0x0818f337 in Fcall_interactively (function=139834337,
record_flag=137731209, keys=137788084)
    at $HOME/gnu/emacs/src/callint.c:383
#29 0x08127672 in Fcommand_execute (cmd=139834337,
record_flag=137731209, keys=137731209, special=137731209)
    at $HOME/gnu/emacs/src/keyboard.c:9693
#30 0x0811a86a in command_loop_1 () at $HOME/gnu/emacs/src/keyboard.c:1788
#31 0x08192bdd in internal_condition_case (bfun=0x8119479
<command_loop_1>, handlers=137792201, hfun=0x8118fb6 <cmd_error>)
    at $HOME/gnu/emacs/src/eval.c:1385
#32 0x081192fb in command_loop_2 () at $HOME/gnu/emacs/src/keyboard.c:1315
#33 0x081926bc in internal_catch (tag=137786201, func=0x81192d8
<command_loop_2>, arg=137731209)
    at $HOME/gnu/emacs/src/eval.c:1144
#34 0x081192b1 in command_loop () at $HOME/gnu/emacs/src/keyboard.c:1294
#35 0x08118d38 in recursive_edit_1 () at $HOME/gnu/emacs/src/keyboard.c:987
#36 0x08118e7d in Frecursive_edit () at $HOME/gnu/emacs/src/keyboard.c:1048
#37 0x081177ad in main (argc=3, argv=0xbfffe674) at
$HOME/gnu/emacs/src/emacs.c:1763

Emacs version is 22.0.50 (daily build, made an hour ago).