--- channels/chan_sip.c.sic	2005-09-29 22:44:45.000000000 +0200
+++ channels/chan_sip.c	2005-10-11 19:16:26.000000000 +0200
@@ -10338,9 +10381,8 @@
 			if (c) {
 				if (replace_id) {
 					if ((refer_pvt = get_sip_pvt_byid_locked(replace_id, req, NULL, p->theirtag))) {
-						if (refer_pvt->owner->_state == AST_STATE_RINGING) {
+						if (refer_pvt->owner && refer_pvt->owner->_state == AST_STATE_RINGING) {
 							transmit_response(p, "100 Trying", req);
-							ast_mutex_unlock(&refer_pvt->owner->lock);
 							ast_mutex_unlock(&refer_pvt->lock);
 							ast_channel_masquerade(refer_pvt->owner, c );
 							ast_hangup(c);
@@ -10353,10 +10395,12 @@
 							} else {
 								ast_log(LOG_WARNING, "SIP Call Replacement (pickup) not successful for CallID: %s\n", p_replaces);
 								transmit_response_with_allow(p, "403 Call Can Not Be Read From", req, 0); /* Don't know if this is the correct answer, but seems to work */
+								ast_mutex_unlock(&refer_pvt->owner->lock);
 								return 0;
 							}
 						} else {
-							ast_mutex_unlock(&refer_pvt->owner->lock);
+							if (refer_pvt->owner)
+								ast_mutex_unlock(&refer_pvt->owner->lock);
 							ast_mutex_unlock(&refer_pvt->lock);
 							ast_hangup(c);
 							ast_log(LOG_WARNING, "SIP Call Replacement (pickup) not possible. Call already answered\n");
@@ -10364,12 +10408,12 @@
 							return 0;
 						}
 					} else {
+						ast_hangup(c);
 						transmit_response_with_allow(p, "481 Call/Transaction Does Not Exist", req, 0);
 						return 0;
 					}
-				}
-				/* Pre-lock the call */
-				ast_mutex_lock(&c->lock);
+				} else
+					ast_mutex_lock(&c->lock); /* Pre-lock the call */
 			}
 		}