The handling of the BYE with Also transfer method was broken during the development of Asterisk 1.4. If a transfer attempt is made using this method the system will immediately crash upon handling the BYE message due to trying to copy data into a NULL pointer. It is important to note that a dialog must have already been established and up in order for this to happen.
http://www.securiteam.com/unixfocus/5TP040KN5S.html
