Just noticed that if you delete all text from the code editor component in the juce demo(winXP) and hit the right arrow button it will cause a crash. It’s breaking at the jassert in the following method from juce_OwnedArray.h, line 130:
/** Returns a pointer to the object at this index in the array, without checking whether the index is in-range.
This is a faster and less safe version of operator[] which doesn't check the index passed in, so
it can be used when you're sure the index if always going to be legal.
*/
inline ObjectClass* getUnchecked (const int index) const throw()
{
data.enter();
jassert (((unsigned int) index) < (unsigned int) numUsed);
ObjectClass* const result = data.elements [index];
data.exit();
return result;
}