I haven't had my coffee yet this morning, but I think you're calling free_vec in s7_free; it tries to unprotect an object, but the sc->protected_objects vector in s7 has already been freed by s7_free.