Comment 4 for bug 697493

That was the key, thanks. I think I've tracked this down, although it's partly guesswork:

revno: 3002
committer: Colin Watson <email address hidden>
branch nick: butter
timestamp: Fri 2011-01-07 17:24:25 +0000
message:
  Always initialise *relroot in grub_find_root_device_from_mountinfo,
  otherwise we free an uninitialised pointer if /proc is unmounted.
  Reported by: Scott Moser.

I'll include this in the next snapshot.