some more details would be great ( like what spurious behaviour exactly you see )

hmm crashes here on linux after selected to print comments to end

this is pretty broken

==1706== Invalid read of size 1
==1706==    at 0x1EC41058: SwViewImp::SetFirstVisPageInvalid() (viewimp.hxx:186)
==1706==    by 0x1EF750D3: ViewShell::SetFirstVisPageInvalid() (viewsh.cxx:907)
==1706==    by 0x1EC58A98: SwPageFrm::Modify(SfxPoolItem const*, SfxPoolItem const*) (pagechg.cxx:554)
==1706==    by 0x1E966638: SwClient::ModifyNotification(SfxPoolItem const*, SfxPoolItem const*) (calbck.hxx:111)
==1706==    by 0x1E969140: SwFmt::~SwFmt() (format.cxx:267)
==1706==    by 0x1EA3BF3E: SwFrmFmt::~SwFrmFmt() (in /data4/OOO_BUILD_GIT/ooo-build/bootstrap/solver/300/unxlngx6.pro/lib/libswlx.so)
==1706==    by 0x1EC5F5BC: SwPageDesc::~SwPageDesc() (pagedesc.cxx:114)
==1706==    by 0x1EC5F691: SwPageDesc::~SwPageDesc() (pagedesc.cxx:116)
==1706==    by 0x1E9D80DB: SwPageDescs::DeleteAndDestroy(unsigned short, unsigned short) (doc.cxx:144)
==1706==    by 0x1EA537E2: SwDoc::~SwDoc() (docnew.cxx:561)
==1706==    by 0x1EA549BB: SwDoc::~SwDoc() (docnew.cxx:664)
==1706==    by 0x1EF7CAFB: ViewShell::~ViewShell() (vnew.cxx:320)
==1706==  Address 0x50 is not stack'd, malloc'd or (recently) free'd
==1706== 
==1706== 
==1706== Process terminating with default action of signal 11 (SIGSEGV): dumping core
==1706==  Access not within mapped region at address 0x50
==1706==    at 0x1EC41058: SwViewImp::SetFirstVisPageInvalid() (viewimp.hxx:186)
==1706==    by 0x1EF750D3: ViewShell::SetFirstVisPageInvalid() (viewsh.cxx:907)
==1706==    by 0x1EC58A98: SwPageFrm::Modify(SfxPoolItem const*, SfxPoolItem const*) (pagechg.cxx:554)
==1706==    by 0x1E966638: SwClient::ModifyNotification(SfxPoolItem const*, SfxPoolItem const*) (calbck.hxx:111)
==1706==    by 0x1E969140: SwFmt::~SwFmt() (format.cxx:267)
==1706==    by 0x1EA3BF3E: SwFrmFmt::~SwFrmFmt() (in /data4/OOO_BUILD_GIT/ooo-build/bootstrap/solver/300/unxlngx6.pro/lib/libswlx.so)
==1706==    by 0x1EC5F5BC: SwPageDesc::~SwPageDesc() (pagedesc.cxx:114)
==1706==    by 0x1EC5F691: SwPageDesc::~SwPageDesc() (pagedesc.cxx:116)
==1706==    by 0x1E9D80DB: SwPageDescs::DeleteAndDestroy(unsigned short, unsigned short) (doc.cxx:144)
==1706==    by 0x1EA537E2: SwDoc::~SwDoc() (docnew.cxx:561)
==1706==    by 0x1EA549BB: SwDoc::~SwDoc() (docnew.cxx:664)
==1706==    by 0x1EF7CAFB: ViewShell::~ViewShell() (vnew.cxx:320)
==1706==  If you believe this happened as a result of a stack
==1706==  overflow in your program's main thread (unlikely but
==1706==  possible), you can try to increase the size of the
==1706==  main thread stack using the --main-stacksize= flag.
==1706==  The main thread stack size used in this run was 8388608.
==1706== Thread 5:
==1706== Invalid free() / delete / delete[]
==1706==    at 0x4C25F7B: free (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so)
==1706==    by 0x60DD2FA: ??? (in /lib64/libc-2.11.2.so)
==1706==    by 0x60DCEA1: ??? (in /lib64/libc-2.11.2.so)
==1706==    by 0x4A215C8: _vgnU_freeres (in /usr/lib64/valgrind/vgpreload_core-amd64-linux.so)
==1706==  Address 0x4048480 is not stack'd, malloc'd or (recently) free'd

that first bad access can be fixed by

diff --git sw/source/core/view/viewsh.cxx sw/source/core/view/viewsh.cxx
index 9903f97..d91c38e 100644
--- sw/source/core/view/viewsh.cxx
+++ sw/source/core/view/viewsh.cxx
@@ -904,7 +904,9 @@ void ViewShell::SetFirstVisPageInvalid()
 {
     ViewShell *pSh = this;
     do
-    {  pSh->Imp()->SetFirstVisPageInvalid();
+    {
+        if ( pSh->Imp() )
+            pSh->Imp()->SetFirstVisPageInvalid();
         pSh = (ViewShell*)pSh->GetNext();
 
     } while ( pSh != this );

but then you get

==4645==    at 0x1EBA74C6: SwViewImp::HasDrawView() const (viewimp.hxx:193)
==4645==    by 0x1EF6EDC4: SwViewImp::NotifySizeChg(Size const&) (vdraw.cxx:202)
==4645==    by 0x1EC59A42: AdjustSizeChgNotify(SwRootFrm*) (pagechg.cxx:867)
==4645==    by 0x1EC5E0EE: SwRootFrm::CheckViewLayout(SwViewOption const*, SwRect const*) (pagechg.cxx:2386)
==4645==    by 0x1EC59225: SwPageFrm::_UpdateAttr(SfxPoolItem const*, SfxPoolItem const*, unsigned char&, SwAttrSetChg*, SwAttrSetChg*) (pagechg.cxx:668)
==4645==    by 0x1EC58C76: SwPageFrm::Modify(SfxPoolItem const*, SfxPoolItem const*) (pagechg.cxx:577)
==4645==    by 0x1E966638: SwClient::ModifyNotification(SfxPoolItem const*, SfxPoolItem const*) (calbck.hxx:111)
==4645==    by 0x1E969140: SwFmt::~SwFmt() (format.cxx:267)
==4645==    by 0x1EA3BF3E: SwFrmFmt::~SwFrmFmt() (in /data4/OOO_BUILD_GIT/ooo-build/bootstrap/solver/300/unxlngx6.pro/lib/libswlx.so)
==4645==    by 0x1EC5F5BC: SwPageDesc::~SwPageDesc() (pagedesc.cxx:114)
==4645==    by 0x1EC5F691: SwPageDesc::~SwPageDesc() (pagedesc.cxx:116)
==4645==    by 0x1E9D80DB: SwPageDescs::DeleteAndDestroy(unsigned short, unsigned short) (doc.cxx:144)
==4645==  Address 0x8 is not stack'd, malloc'd or (recently) free'd
==4645== 
==4645== 
==4645== Process terminating with default action of signal 11 (SIGSEGV): dumping core
==4645==  Access not within mapped region at address 0x8
==4645==    at 0x1EBA74C6: SwViewImp::HasDrawView() const (viewimp.hxx:193)
==4645==    by 0x1EF6EDC4: SwViewImp::NotifySizeChg(Size const&) (vdraw.cxx:202)
==4645==    by 0x1EC59A42: AdjustSizeChgNotify(SwRootFrm*) (pagechg.cxx:867)
==4645==    by 0x1EC5E0EE: SwRootFrm::CheckViewLayout(SwViewOption const*, SwRect const*) (pagechg.cxx:2386)
==4645==    by 0x1EC59225: SwPageFrm::_UpdateAttr(SfxPoolItem const*, SfxPoolItem const*, unsigned char&, SwAttrSetChg*, SwAttrSetChg*) (pagechg.cxx:668)
==4645==    by 0x1EC58C76: SwPageFrm::Modify(SfxPoolItem const*, SfxPoolItem const*) (pagechg.cxx:577)
==4645==    by 0x1E966638: SwClient::ModifyNotification(SfxPoolItem const*, SfxPoolItem const*) (calbck.hxx:111)
==4645==    by 0x1E969140: SwFmt::~SwFmt() (format.cxx:267)
==4645==    by 0x1EA3BF3E: SwFrmFmt::~SwFrmFmt() (in /data4/OOO_BUILD_GIT/ooo-build/bootstrap/solver/300/unxlngx6.pro/lib/libswlx.so)
==4645==    by 0x1EC5F5BC: SwPageDesc::~SwPageDesc() (pagedesc.cxx:114)
==4645==    by 0x1EC5F691: SwPageDesc::~SwPageDesc() (pagedesc.cxx:116)
==4645==    by 0x1E9D80DB: SwPageDescs::DeleteAndDestroy(unsigned short, unsigned short) (doc.cxx:144)

so.. I think we are a loser with this approach, there is some order dependency we need to fix ( perhaps we need to remove a listener somewhere further up the stack when destructing or something ) needs some comparison probably with 3.3  ( which worked )

Created attachment 46565 [details]
patch

I persevered and eventually seem to have hacked full set of tests to avoid the bad pointer access(s) ( I still think this is *not* the correct solution ) but it does work ( and valgrind seems happy with all print variations re. comments ) and it prevents the core :-/ imo worth putting into 3.4 unless someone comes up with a better fix

commit ed0f8821d6a0bb61e061747d2b0875fd1c346a5e
Author: Noel Power <nopower@novell.com>
Date:   Wed May 11 13:51:16 2011 +0200

    Fix crash when printing comments, fdo#37045.

*** Bug 37317 has been marked as a duplicate of this bug. ***