This is from 1.4.24 but the crash is present in 1.4.29 as for as I can tell.

#0  0xffffe410 in __kernel_vsyscall ()
#1  0xb7d5c875 in raise () from /lib/tls/i686/cmov/libc.so.6
#2  0xb7d5e201 in abort () from /lib/tls/i686/cmov/libc.so.6
#3  0xb7d55b6e in __assert_fail () from /lib/tls/i686/cmov/libc.so.6
#4  0xb7f0063e in pthread_mutex_lock () from /lib/tls/i686/cmov/libpthread.so.0
#5  0xb7513051 in __ast_pthread_mutex_lock (filename=0xb7516ff4 "app_chanspy.c", lineno=505, func=0xb7518a6c "chanspy_ds_destroy", 
    mutex_name=0xb7518a7f "&chanspy_ds->lock", t=0xb4cc5be0)
    at /usr/src/asterisk-1.4.24-ast-20090702/asterisk-apid/asterisk-1.4.24-ast-20090702/include/asterisk/lock.h:406
#6  0xb75147c9 in chanspy_ds_destroy (data=0xb4cc5bc8) at app_chanspy.c:505
#7  0x0808cfbd in ast_channel_datastore_free (datastore=0x8a4f0e8) at channel.c:1341
#8  0x0808c6a1 in ast_channel_free (chan=0x8c5c170) at channel.c:1242
#9  0x0808d97c in ast_hangup (chan=0x8c5c170) at channel.c:1552
#10 0x080e1133 in __ast_pbx_run (c=0x8c5c170) at pbx.c:2576
#11 0x080e1393 in pbx_thread (data=0x8c5c170) at pbx.c:2636
#12 0x0812bb4f in dummy_start (data=0x874d1f8) at utils.c:856
#13 0xb7efe46b in start_thread () from /lib/tls/i686/cmov/libpthread.so.0
#14 0xb7e056de in clone () from /lib/tls/i686/cmov/libc.so.6