As reported by kkylheku@gmail.com:

$ cat popen_getwc.c
#include <unistd.h>
#include <stdio.h>
#include <wchar.h>

int main(void)
{
  FILE *command = popen("ls", "r");
  wint_t ch = getwc(command);
  pclose(command);
  return ch;
}
$ gcc -Wall popen_getwc.c -o popen_getwc
$ ./popen_getwc
Segmentation fault

The crash is unaffected by whether or not we call setlocale to have LC_CTYPE set
up for multi-byte encodings or not.

(This was originally reported for glibc-2.3.something, but is reproducible for
me on glibc-2.10.1 as well; I'm still to check on 2.11.)

The recipe for workaround is: Create the FILE * command stream with popen. Then
pull out the file descriptor with fileno, duplicate it with dup, and use fdopen
to create a new FILE * descriptor on the duplicate. Then use the new FILE * in
place of the old for I/O operations.  Keep the original handle in order to call
pclose, to collect the process exit status.