Index: channels/chan_sip.c
===================================================================
--- channels/chan_sip.c	(revision 306862)
+++ channels/chan_sip.c	(working copy)
@@ -27493,6 +27493,7 @@
 		return -1;
 	}
 	sip_pvt_lock(p);
+	dialog_ref(p, "in sip_set_udptl_peer: Inc refs so pvt doesn't accidentally become dead before we are done");
 	if (udptl) {
 		ast_udptl_get_peer(udptl, &p->udptlredirip);
 	} else {
@@ -27502,7 +27503,9 @@
 		if (!p->pendinginvite) {
 			ast_debug(3, "Sending reinvite on SIP '%s' - It's UDPTL soon redirected to IP %s\n",
 					p->callid, ast_sockaddr_stringify(udptl ? &p->udptlredirip : &p->ourip));
+			sip_pvt_unlock(p);
 			transmit_reinvite_with_sdp(p, TRUE, FALSE);
+			sip_pvt_lock(p);
 		} else if (!ast_test_flag(&p->flags[0], SIP_PENDINGBYE)) {
 			ast_debug(3, "Deferring reinvite on SIP '%s' - It's UDPTL will be redirected to IP %s\n",
 					p->callid, ast_sockaddr_stringify(udptl ? &p->udptlredirip : &p->ourip));
@@ -27512,6 +27515,7 @@
 	/* Reset lastrtprx timer */
 	p->lastrtprx = p->lastrtptx = time(NULL);
 	sip_pvt_unlock(p);
+	dialog_unref(p, "in sip_set_udptl_peer: Dec ref count so pvt can become dead");
 	return 0;
 }
 
@@ -27642,6 +27646,8 @@
 		return 0;
 	}
 
+	dialog_ref(p, "in sip_set_rtp_peer: Inc refs so pvt doesn't accidentally become dead before we are done");
+
 	if (instance) {
 		changed |= ast_rtp_instance_get_and_cmp_remote_address(instance, &p->redirip);
 	} else if (!ast_sockaddr_isnull(&p->redirip)) {
@@ -27671,7 +27677,9 @@
 			ast_debug(1, "Early remote bridge setting SIP '%s' - Sending media to %s\n", p->callid, ast_sockaddr_stringify(instance ? &p->redirip : &p->ourip));
 		} else if (!p->pendinginvite) {	 /* We are up, and have no outstanding invite */
 			ast_debug(3, "Sending reinvite on SIP '%s' - It's audio soon redirected to IP %s\n", p->callid, ast_sockaddr_stringify(instance ? &p->redirip : &p->ourip));
+			sip_pvt_unlock(p);
 			transmit_reinvite_with_sdp(p, FALSE, FALSE);
+			sip_pvt_lock(p);
 		} else if (!ast_test_flag(&p->flags[0], SIP_PENDINGBYE)) {
 			ast_debug(3, "Deferring reinvite on SIP '%s' - It's audio will be redirected to IP %s\n", p->callid, ast_sockaddr_stringify(instance ? &p->redirip : &p->ourip));
 			/* We have a pending Invite. Send re-invite when we're done with the invite */
@@ -27681,6 +27689,7 @@
 	/* Reset lastrtprx timer */
 	p->lastrtprx = p->lastrtptx = time(NULL);
 	sip_pvt_unlock(p);
+	dialog_unref(p, "in sip_set_rtp_peer: Dec ref count so pvt can become dead");
 	return 0;
 }
 
Index: main/rtp_engine.c
===================================================================
--- main/rtp_engine.c	(revision 306862)
+++ main/rtp_engine.c	(working copy)
@@ -1202,10 +1202,15 @@
 		cs[1] = cs[2];
 	}
 
-	if (glue0->update_peer(c0, NULL, NULL, NULL, 0, 0)) {
+	if (ast_test_flag(c0, AST_FLAG_ZOMBIE)) {
+		ast_debug(1, "Channel '%s' Zombie cleardown from bridge\n", c0->name);
+	} else if (glue0->update_peer(c0, NULL, NULL, NULL, 0, 0)) {
 		ast_log(LOG_WARNING, "Channel '%s' failed to break RTP bridge\n", c0->name);
 	}
-	if (glue1->update_peer(c1, NULL, NULL, NULL, 0, 0)) {
+
+	if (ast_test_flag(c1, AST_FLAG_ZOMBIE)) {
+		ast_debug(1, "Channel '%s' Zombie cleardown from bridge\n", c1->name);
+	} else if (glue1->update_peer(c1, NULL, NULL, NULL, 0, 0)) {
 		ast_log(LOG_WARNING, "Channel '%s' failed to break RTP bridge\n", c1->name);
 	}