Found by Ryan who posted to the Learn group:
http://forum.dlang.org/post/vuhulvwgtahinnknntvv@forum.dlang.org

Reduced test case:
----
import std.experimental.allocator: dispose, makeArray;
import std.experimental.allocator.gc_allocator: GCAllocator;
import std.experimental.allocator.mallocator: Mallocator;
import std.experimental.allocator.building_blocks: FreeTree;

void f(ParentAllocator)(size_t sz)
{
  static FreeTree!ParentAllocator myAlloc;
  byte[] _payload = myAlloc.makeArray!byte(sz, 0);
  assert(_payload, "_payload is null"); /* passes */
  myAlloc.dispose(_payload);
}

version(malloc) void main()
{
  f!Mallocator(33);
  f!Mallocator(43);
}

version (gc) void main()
{
  f!GCAllocator(1);
}
----

Both versions segfault in Linux.

The malloc version seems to need slightly different numbers for the second call, depending on details like the version of dmd. On my machine, compiled with git master dmd, the segfaults occurs with a value of 41 or higher, and 2.071.1 needs 42 or higher. On DPaste, 2.071.1 needs 43 or higher.

No segfault with Windows dmd, tested in Wine.