in src/internet-stack/tcp-test.cc, uncomment line 336 and witness the tcp testcase crashing. I did not debug this seriously, but this looks like a socket lifetime bug. 

Here is the end of the debug log NS_LOG=TcpSocketImpl:TcpL4Protocol

0s TcpL4Protocol:Receive(): TcpL4Protocol 0x9b750b8 receiving seq 100001 ack 100001 flags 10 data size 20
0s TcpL4Protocol:Receive(): TcpL4Protocol 0x9b750b8 received a packet
0s TcpL4Protocol:Receive(): TcpL4Protocol 0x9b750b8 forwarding up to endpoint/socket
0s TcpSocketImpl:ForwardUp(): Socket 0x9b73728 got forward up dport 49153 daddr 192.168.1.2 sport 50000 saddr 192.168.1.1
0s TcpSocketImpl:ForwardUp(0x9b73728, 0x9bbe8a8, 192.168.1.1, 50000)
0s TcpL4Protocol:FlagsEvent(0x9b73920, )
0s TcpSocketImpl:ProcessEvent(0x9b73728, 6)
0s TcpSocketImpl:ProcessEvent(): TcpSocketImpl 0x9b73728 processing event 6
0s TcpL4Protocol:Lookup(0x9b73920, 6, 6)
0s TcpSocketImpl:ProcessEvent(): TcpSocketImpl::ProcessEvent stateAction 13
0s TcpSocketImpl:ProcessEvent(): TcpSocketImpl 0x9b73728 moved from state 6 to state 0
0s TcpSocketImpl:ProcessEvent(): TcpSocketImpl 0x9b73728 pendingData 0
0s TcpSocketImpl:ProcessEvent(): TcpSocketImpl 0x9b73728 transition to CLOSED from 0 event 6 closeNot 0 action 13
0s TcpSocketImpl:ProcessEvent(): TcpSocketImpl 0x9b73728 calling Closed from PE origState 6 event 6
0s TcpSocketImpl:ProcessEvent(): TcpSocketImpl 0x9b73728 transition to CLOSED from 0 event 6 set CloseNotif 
0s TcpL4Protocol:DeAllocate(0x9b73668, 0x9b73970)
0s TcpSocketImpl:ForwardUp(): Socket 0x9b73728 processing pkt action, 13 current state 0
0s TcpSocketImpl:ProcessPacketAction(0x9b73728, 13, 0x9bbe8a8, 05-06-c0:a8:01:01:50:c3)
0s TcpSocketImpl:ProcessAction(0x9b73728, 13)
0s TcpSocketImpl:ProcessAction(): TcpSocketImpl 0x9b73728 Action APP_CLOSED
0s TcpSocketImpl:ReTxTimeout(0x9b74108)
0s TcpSocketImpl:ReTxTimeout(): 0x9b74108 ReTxTimeout Expired at time 0
0s TcpSocketImpl:Window()
0s TcpSocketImpl:Window(): TcpSocketImpl::Window() 0x9b74108
0s TcpSocketImpl:Retransmit(0x9b74108)
0s TcpSocketImpl:Retransmit(): TcpSocketImpl 0x9b74108 retxing seq 99361
0s TcpSocketImpl:Retransmit(): 0x9b74108 Schedule ReTxTimeout at time 0 to expire at time 0
0s TcpL4Protocol:SendPacket(): TcpL4Protocol 0x9b750b8 sending seq 99361 ack 100002 flags 0 data size 536
0s TcpL4Protocol:SendPacket(0x9b750b8, 0x9bbe8a8, 192.168.1.1, 192.168.1.2)
0s TcpL4Protocol:Receive(0x9b73668, 0x9bbe868, 192.168.1.1, 192.168.1.2, 0x9b730b8)
0s TcpL4Protocol:Receive(): TcpL4Protocol 0x9b73668 receiving seq 99361 ack 100002 flags 0 data size 556
0s TcpL4Protocol:Receive(): TcpL4Protocol 0x9b73668 received a packet
0s TcpL4Protocol:Receive():   No endpoints matched on TcpL4Protocol 0x9b73668
0s TcpL4Protocol:Receive():   destination IP: 192.168.1.2 destination port: 49153 source IP: 192.168.1.1 source port: 50000

and backtrace: 

Program received signal SIGSEGV, Segmentation fault.
0x01124056 in ns3::Callback<void, ns3::Ptr<ns3::Packet>, ns3::Ipv4Address, unsigned short, ns3::empty, ns3::empty, ns3::empty, ns3::empty, ns3::empty, ns3::empty>::operator() (this=0x807c990, a1={m_ptr = 0x81bd008}, a2={m_address = 3232235777}, a3=50000)
    at debug/ns3/callback.h:429
429	    return (*(DoPeekImpl ())) (a1,a2,a3);
Missing separate debuginfos, use: debuginfo-install libxcb-1.1.91-7.fc10.i386 libxml2-2.7.3-2.fc10.i386
(gdb) bt
#0  0x01124056 in ns3::Callback<void, ns3::Ptr<ns3::Packet>, ns3::Ipv4Address, unsigned short, ns3::empty, ns3::empty, ns3::empty, ns3::empty, ns3::empty, ns3::empty>::operator() (this=0x807c990, a1={m_ptr = 0x81bd008}, a2={m_address = 3232235777}, a3=50000)
    at debug/ns3/callback.h:429
#1  0x01123859 in ns3::Ipv4EndPoint::DoForwardUp (this=0x807c980, p={m_ptr = 0x81bd008}, saddr={m_address = 3232235777}, sport=50000)
    at ../src/internet-stack/ipv4-end-point.cc:106
#2  0x01123a02 in Notify (this=0x81b8810) at debug/ns3/make-event.h:167
#3  0x00f505b2 in ns3::EventImpl::Invoke (this=0x81b8810) at ../src/simulator/event-impl.cc:39
#4  0x00f6f949 in ns3::DefaultSimulatorImpl::ProcessOneEvent (this=0x807e030) at ../src/simulator/default-simulator-impl.cc:113
#5  0x00f6f9a6 in ns3::DefaultSimulatorImpl::Run (this=0x807e030) at ../src/simulator/default-simulator-impl.cc:143
#6  0x00f58c3b in ns3::Simulator::Run () at ../src/simulator/simulator.cc:160
#7  0x010f4448 in ns3::TcpTestCase::DoRun (this=0x805e798) at ../src/internet-stack/tcp-test.cc:144
#8  0x00c615bf in ns3::TestCase::Run (this=0x805e798) at ../src/core/test.cc:151
#9  0x00c622fc in ns3::TestSuite::DoRun (this=0x1775420) at ../src/core/test.cc:606
#10 0x00c61350 in ns3::TestSuite::Run (this=0x1775420) at ../src/core/test.cc:412
#11 0x08049e2e in main (argc=3, argv=0xbffff384) at ../utils/test-runner.cc:251
(gdb)