As said elsewhere, locking X is really hard, and xscreensaver architecture doesn't help. This week I managed to crash xscreensaver login prompt twice, unlocking the desktop without entering my password, and that was the last straw, I switched to xsecurelock which separates the login entry into another process, making such bugs much less severe.
Unfortunately I can't reliably reproduce the crash. A hardware fuzzer (also known as a faulty ThinkPad keyboard) was involved, and I don't possess the device any more. I think what it did was press certain keys very often — the keyboard matrix is sampled at 125 Hz, so I'm guessing it was pressing the keys about 60 times per second, but I'm not sure which keys they were. If anyone manages to reproduce this, please do give me a shout. :-)