nftw(3) crashes with latest libc

[jarun]

reproduction: press S is any directory to run in du mode.

libc6 versions: 2.23-0ubuntu9 (and the previous one)
kernel: 4.4.0-87-generic (4.4.0.87.93) amd64

output:

Calculating...
              Program received signal SIGSEGV, Segmentation fault.
                                                                  0x00007ffff7468579 in ?? () from /lib/x86_64-linux-gnu/libc.so.6

backtrace:

(gdb) bt full
#0  0x00007ffff7468579 in ?? () from /lib/x86_64-linux-gnu/libc.so.6
No symbol table info available.
#1  0x0000000000402b99 in dentfill (dents=0x614280 <dents>, filter=<optimized out>, re=0x60dc80 <re>, path=0x7fffffff9cc0 "/home/vaio/GitHub/nnn") at nnn.c:1660
        fd = 4
        namep = 0x74b473 "redhat"
        dentp = 0x746c20
        dirp = 0x74b430
        sb = {st_dev = 2050, st_ino = 3285019, st_nlink = 2, st_mode = 16893, st_uid = 1001, st_gid = 1001, __pad0 = 0, st_rdev = 0, st_size = 4096, st_blksize = 4096, st_blocks = 8, 
          st_atim = {tv_sec = 1500917387, tv_nsec = 310109830}, st_mtim = {tv_sec = 1500917387, tv_nsec = 310109830}, st_ctim = {tv_sec = 1500917387, tv_nsec = 310109830}, __glibc_reserved = {
            0, 0, 0}}
        n = 0
#2  populate (fltr=0x7fffffff84c0 "^[^.]", oldpath=0x7fffffffacc0 "/home/vaio/GitHub/nnn/misc", path=0x7fffffff9cc0 "/home/vaio/GitHub/nnn") at nnn.c:1732
        re = {buffer = 0x742510 " \331s", allocated = 224, used = 224, syntax = 4436732, fastmap = 0x742400 '\001' <repeats 46 times>, translate = 0x0, re_nsub = 0, can_be_null = 0, 
          regs_allocated = 0, fastmap_accurate = 1, no_sub = 1, not_bol = 0, not_eol = 0, newline_anchor = 0}
#3  browse (ifilter=0x406c6b "^[^.]", ipath=0x7fffffff8cc0 "/home/vaio/GitHub/nnn") at nnn.c:1871
        newpath = '\000' <repeats 4095 times>
        fltr = "^[^.]", '\000' <repeats 2042 times>
        dir = <optimized out>
        env = <optimized out>
        tgt = 0x0
        path = "/home/vaio/GitHub/nnn", '\000' <repeats 4074 times>
        r = <optimized out>
        sel = <optimized out>
        lastdir = '\000' <repeats 664 times>...
        tmp = <optimized out>
        run = <optimized out>
        fd = <optimized out>
        oldpath = "/home/vaio/GitHub/nnn/misc", '\000' <repeats 4069 times>
        sb = {st_dev = 0, st_ino = 0, st_nlink = 0, st_mode = 0, st_uid = 0, st_gid = 0, __pad0 = 0, st_rdev = 0, st_size = 0, st_blksize = 0, st_blocks = 0, st_atim = {tv_sec = 0, 
            tv_nsec = 0}, st_mtim = {tv_sec = 0, tv_nsec = 0}, st_ctim = {tv_sec = 0, tv_nsec = 0}, __glibc_reserved = {0, 0, 0}}
        presel = 0
#4  main (argc=<optimized out>, argv=<optimized out>) at nnn.c:2569
        cwd = "/home/vaio/GitHub/nnn", '\000' <repeats 4074 times>
        ipath = 0x7fffffff8cc0 "/home/vaio/GitHub/nnn"
        ifilter = <optimized out>
        bmstr = <optimized out>
        opt = <optimized out>
(gdb)

[jarun]

The issue is with optimizing the max open file descriptors for the process.