_int_free() (malloc/malloc.c), which is called from free() with arena mutex locked, checks and eventually prints/logs error message. So if malloc_printerr() handling do some malloc()/free() on the same memory arena, deadlock can occur. vsyslog() can call free() during tz manipulation. Yes, this deadlock is triggered by buggy code. But it's all inside libc, not caused by actual memory corruption.
Oops, refreshed wrong page... *** This bug has been marked as a duplicate of 770 ***