AFL (<http://lcamtuf.coredump.cx/afl>) finds this:
% ./miniperl -e 'stat-t'
When trying to stack filetests, ck_ftst() checks that the kid is not a stat or lstat, but doesn't check the parent. I think the fix is just to add the check:
.. and will push that with a test if nobody disagrees.