Crash in transformations

I'm seeing an easy to reproduce crash in 4.2.0 and master (5.0.0), so I'm assuming it was introduced between 3.2.x and 4.1.0. To reproduce I'm using a simple null transformation plugin and just making repeated curl requests.

HttpTunnel::consumer_handler (this=0x7fffea652db8, event=103, c=0x7fffea652e08) at HttpTunnel.cc:1300
1300 c->buffer_reader->mbuf->dealloc_reader(c->buffer_reader);
(gdb) bt
#0 HttpTunnel::consumer_handler (this=0x7fffea652db8, event=103, c=0x7fffea652e08) at HttpTunnel.cc:1300
#1 0x00000000005e6a2d in HttpTunnel::main_handler (this=0x7fffea652db8, event=<optimized out>, data=<optimized out>) at HttpTunnel.cc:1525
#2 0x00007ffff27e9981 in handleTransformationPluginRead (state=0x7fffa00d7db0, contp=0x7fffd4021b70) at TransformationPlugin.cc:175
#3 (anonymous namespace)::handleTransformationPluginEvents (contp=<optimized out>, event=<optimized out>, edata=<optimized out>)
at TransformationPlugin.cc:217
#4 0x000000000073792f in handleEvent (data=0x7fffdc18fbf0, event=1, this=<optimized out>) at I_Continuation.h:181
#5 EThread::process_event (this=0x7ffff67d5010, e=0x7fffdc18fbf0, calling_code=1) at UnixEThread.cc:145
#6 0x000000000073845b in EThread::execute (this=0x7ffff67d5010) at UnixEThread.cc:196
#7 0x0000000000736cda in spawn_thread_internal (a=0x10898d0) at Thread.cc:88
#8 0x00000033a1607851 in start_thread () from /lib64/libpthread.so.0
#9 0x00000033a12e890d in clone () from /lib64/libc.so.6

A sample debug output is available: http://apaste.info/aPK