Version:            (using KDE KDE 3.5.4)
Installed from:    Ubuntu Packages

Ok this a slightly weird and obscure, but reliably reproducible crash.

To reproduce (example, probably works for much more general cases).

Download a file from sourceforge.

Select a mirror from the mirror page.

Click the "If your download has not started, click [here] to download it" type link immediately.

Select Save-As.

Wait for the auto-download "[Save-As], [Open], [Cancel]" dialog to appear.

Cancel it.

Now select a location to save the original download and click OK.

Konqueror crashes.

Here is a backtrace:

(no debugging symbols found)
Using host libthread_db library "/lib/tls/i686/cmov/libthread_db.so.1".
(no debugging symbols found)
...snip...
(no debugging symbols found)
[Thread debugging using libthread_db enabled]
[New Thread -1232804160 (LWP 9328)]
(no debugging symbols found)
...snip...
(no debugging symbols found)
[KCrash handler]
#6  0xb711671e in QShared::ref () from /usr/lib/libqt-mt.so.3
#7  0xb750e33d in QString::operator= () from /usr/lib/libqt-mt.so.3
#8  0xb779011a in KURL::operator= () from /usr/lib/libkdecore.so.4
#9  0xb77cda31 in KURL::KURL () from /usr/lib/libkdecore.so.4
#10 0xb7eeb295 in QValueListPrivate<KURL>::insert ()
   from /usr/lib/libkparts.so.2
#11 0xb7aa37c6 in KIO::copy () from /usr/lib/libkio.so.4
#12 0xb7ee8e0b in KParts::BrowserRun::simpleSave ()
   from /usr/lib/libkparts.so.2
#13 0xb7ee9428 in KParts::BrowserRun::save () from /usr/lib/libkparts.so.2
#14 0xb7ee83d0 in KParts::BrowserRun::handleNonEmbeddable ()
   from /usr/lib/libkparts.so.2
#15 0xb66e03af in KonqRun::foundMimeType ()
   from /usr/lib/libkdeinit_konqueror.so
#16 0xb7ee7d7e in KParts::BrowserRun::slotBrowserMimetype ()
   from /usr/lib/libkparts.so.2
#17 0xb7ee800d in KParts::BrowserRun::qt_invoke ()
   from /usr/lib/libkparts.so.2
#18 0xb66b5ac7 in KonqRun::qt_invoke () from /usr/lib/libkdeinit_konqueror.so
#19 0xb71f0eb9 in QObject::activate_signal () from /usr/lib/libqt-mt.so.3
#20 0xb7a3f787 in KIO::TransferJob::mimetype () from /usr/lib/libkio.so.4
#21 0xb7a3f7ea in KIO::TransferJob::slotMimetype () from /usr/lib/libkio.so.4
#22 0xb7a9d3b2 in KIO::TransferJob::qt_invoke () from /usr/lib/libkio.so.4
#23 0xb71f0eb9 in QObject::activate_signal () from /usr/lib/libqt-mt.so.3
#24 0xb71f13ea in QObject::activate_signal () from /usr/lib/libqt-mt.so.3
#25 0xb7a4d61b in KIO::SlaveInterface::mimeType () from /usr/lib/libkio.so.4
#26 0xb7aad792 in KIO::SlaveInterface::dispatch () from /usr/lib/libkio.so.4
#27 0xb7a81620 in KIO::SlaveInterface::dispatch () from /usr/lib/libkio.so.4
#28 0xb7a76730 in KIO::Slave::gotInput () from /usr/lib/libkio.so.4
#29 0xb7a7aa87 in KIO::Slave::qt_invoke () from /usr/lib/libkio.so.4
#30 0xb71f0eb9 in QObject::activate_signal () from /usr/lib/libqt-mt.so.3
#31 0xb71f17c8 in QObject::activate_signal () from /usr/lib/libqt-mt.so.3
#32 0xb758506f in QSocketNotifier::activated () from /usr/lib/libqt-mt.so.3
#33 0xb72111fe in QSocketNotifier::event () from /usr/lib/libqt-mt.so.3
#34 0xb7186e56 in QApplication::internalNotify () from /usr/lib/libqt-mt.so.3
#35 0xb7187052 in QApplication::notify () from /usr/lib/libqt-mt.so.3
#36 0xb78657ab in KApplication::notify () from /usr/lib/libkdecore.so.4
#37 0xb7118157 in QApplication::sendEvent () from /usr/lib/libqt-mt.so.3
#38 0xb7178973 in QEventLoop::activateSocketNotifiers ()
   from /usr/lib/libqt-mt.so.3
#39 0xb712bf43 in QEventLoop::processEvents () from /usr/lib/libqt-mt.so.3
#40 0xb719f947 in QEventLoop::enterLoop () from /usr/lib/libqt-mt.so.3
#41 0xb719f86a in QEventLoop::exec () from /usr/lib/libqt-mt.so.3
#42 0xb7185965 in QApplication::exec () from /usr/lib/libqt-mt.so.3
#43 0xb66f4c11 in kdemain () from /usr/lib/libkdeinit_konqueror.so
#44 0xb7f054f4 in kdeinitmain () from /usr/lib/kde3/konqueror.so
#45 0x0804e173 in ?? ()
#46 0x00000002 in ?? ()
#47 0x08142608 in ?? ()
#48 0x00000001 in ?? ()
#49 0x00000000 in ?? ()

I was using KHTML 3.5.4, and downloading the latest wine source from the dublin mirror, though I doubt it makes any difference.

Also may be important, while the crash handler dialog is showing, there is a "Progress Dialogue" window still visible (0%, blank source and destination).