Nope i do not work on modified sources. It's from the 1.10.4 subversion checkout.

And as i said it was just a quick guess. If you trace back from playmp_controller::play_network_turn() - where the turn_info object is allocated with the ref of replay_sender_ and compare it with the crash trace it looks like that there is something wrong with the deque. I do not well understand the relations between the network and replay stuff and i just thought it might give you a start to look at. Maybe it is something Mac related idk. Let me know if you need more information or if there is something i could do to help you.

Hi Mates.
I'm new to Wesnoth and this bug report might be wrong placed.

After watching some MP games as observer the game crashed sometimes with this log trace:

Process: Wesnoth [40601]
Path: /Volumes/Data/Applications/Wesnoth.app/Contents/MacOS/./Wesnoth
Identifier: org.wesnoth.Wesnoth
Version: 1.10.4 (1.10.4)
Code Type: X86 (Native)
Parent Process: bash [40378]

Date/Time: 2012-10-18 01:31:59.119 +0200
OS Version: Mac OS X 10.6.8 (10K549)
Report Version: 6

Exception Type: EXC_CRASH (SIGSEGV)
Exception Codes: 0x0000000000000000, 0x0000000000000000
Crashed Thread: 1 Dispatch queue: com.apple.libdispatch-manager

Thread 0: Dispatch queue: com.apple.main-thread

1. org.wesnoth.Wesnoth 0x00144383 void std::_Destroy<std::_Deque_iterator<map_location, map_location&, map_location>, std::allocator<map_location> >(std::_Deque_iterator<map_location, map_location&, map_location>, std::_Deque_iterator<map_location, map_location&, map_location*>, std::allocator<map_location>) + 31

1 org.wesnoth.Wesnoth 0x00144d0a std::deque<map_location, std::allocator<map_location> >::~deque() + 102
2 org.wesnoth.Wesnoth 0x00144d37 replay::~replay() + 21
3 org.wesnoth.Wesnoth 0x00151d0f turn_info::~turn_info() + 51
4 org.wesnoth.Wesnoth 0x0015fb23 playmp_controller::play_network_turn() + 955
5 org.wesnoth.Wesnoth 0x0015ffaa playmp_controller::play_side(unsigned int, bool) + 1148
6 org.wesnoth.Wesnoth 0x00158588 playsingle_controller::play_turn(bool) + 1114
7 org.wesnoth.Wesnoth 0x0015b193 playsingle_controller::play_scenario(std::pair<config::const_child_iterator, config::const_child_iterator> const&, bool) + 2777
8 org.wesnoth.Wesnoth 0x00163799 play_game(display&, game_state&, config const&, io_type_t, bool) + 11611
9 org.wesnoth.Wesnoth 0x001aad39 enter_wait_mode(game_display&, config const&, mp::chat&, config&, bool) + 395
10 org.wesnoth.Wesnoth 0x001af763 mp::start_client(game_display&, config const&, std::string const&) + 16595
11 org.wesnoth.Wesnoth 0x0061af32 game_controller::play_multiplayer() + 1674
12 org.wesnoth.Wesnoth 0x00290225 SDL_main + 3321

After looking at the source code file 'replay.hpp' it looks like that the member:

180: std::deque<map_location> expected_advancements_;

is not properly initialized within the constructor. And if the game tries to 'deallocate' the replay object the game crashes with the above trace.
This is just a quick guess so better do not count on that to much, but maybe it helps.