NM crashes when restarted on arale

Discovered this while testing for another bug; I hadn't run into this problem before:

NetworkManager[3456]: <info> startup complete
NetworkManager[3456]: <info> (/ril_0) modem is now Online
NetworkManager[3456]: <info> (/ril_0): update_modem_state: 'Attached': false 'Online': true 'IMSI': (null)
NetworkManager[3456]: <info> (ril_0): modem state changed, 'initializing' --> 'disabled' (reason: modem not ready)
NetworkManager[3456]: <info> (/ril_0) updated available interfaces
NetworkManager[3456]: <info> (/ril_0): found new SimManager interface
NetworkManager[3456]: <info> (/ril_0): found new ConnectionManager interface
NetworkManager[3456]: <info> GetPropsDone: 'SubscriberIdentity': (null)
NetworkManager[3456]: <info> (/ril_0): update_modem_state: 'Attached': false 'Online': true 'IMSI': 302500200836319

Program received signal SIGSEGV, Segmentation fault.
0xb690606e in strlen () from /lib/arm-linux-gnueabihf/libc.so.6
(gdb) bt full
#0 0xffffffff in strlen () at /lib/arm-linux-gnueabihf/libc.so.6
#1 0xffffffff in vfprintf () at /lib/arm-linux-gnueabihf/libc.so.6
#2 0xffffffff in __vasprintf_chk () at /lib/arm-linux-gnueabihf/libc.so.6
#3 0xffffffff in g_vasprintf (__ap=..., __fmt=<optimized out>, __ptr=0xbefff1f8) at /usr/include/arm-linux-gnueabihf/bits/stdio2.h:210
        __func__ = "g_vasprintf"
#4 0xffffffff in g_vasprintf (string=string@entry=0xbefff1f8, format=format@entry=0xb2ace180 "(%s): modem state changed, '%s' --> '%s' (reason: %s)\n", args=...) at /build/glib2.0-hi_vf7/glib2.0-2.45.8/./glib/gprintf.c:316
        __func__ = "g_vasprintf"
#5 0xffffffff in g_strdup_vprintf (format=format@entry=0xb2ace180 "(%s): modem state changed, '%s' --> '%s' (reason: %s)\n", args=..., args@entry=...)
    at /build/glib2.0-hi_vf7/glib2.0-2.45.8/./glib/gstrfuncs.c:514
        string = 0x0
#6 0x000a0d04 in _nm_log_impl (file=0xb2acdf70 "nm-modem.c", line=line@entry=153, func=0xb2acdd60 <__func__.33002> "nm_modem_set_state", level=level@entry=LOGL_INFO, domain=domain@entry=LOGD_MB, error=error@entry=0, fmt=0xb2ace180 "(%s): modem state changed, '%s' --> '%s' (reason: %s)\n") at nm-logging.c:388
        args = {__ap = 0xbefff260}
        msg = <optimized out>
        fullmsg = 0x0
        tv = {tv_sec = -1232066209, tv_usec = -1226609788}
        syslog_level = 6
---Type <return> to continue, or q <return> to quit---
        g_log_level = 64
        __func__ = "_nm_log_impl"
#7 0xffffffff in nm_modem_set_state (self=0x1eb8e0 [NMModemOfono], new_state=NM_MODEM_STATE_UNKNOWN, reason=0x1 <error: Cannot access memory at address 0x1>)
    at nm-modem.c:149
        priv = <optimized out>
        old_state = NM_MODEM_STATE_DISABLED
        __func__ = "nm_modem_set_state"
#8 0xffffffff in update_modem_state (self=self@entry=0x1eb8e0 [NMModemOfono])
    at nm-modem-ofono.c:124
        priv = <optimized out>
        state = <optimized out>
        new_state = <optimized out>
        reason = <optimized out>
        __func__ = "update_modem_state"
#9 0xffffffff in handle_subscriber_identity (self=self@entry=0x1eb8e0 [NMModemOfono], value=value@entry=0x1dd368) at nm-modem-ofono.c:334
        priv = <optimized out>
        value_str = <optimized out>
        __func__ = "handle_subscriber_identity"
#10 0xffffffff in get_ofono_sim_properties_done (proxy=0x1daf80 [DBusGProxy], call_id=0x1, user_data=0x1eb8e0) at nm-modem-ofono.c:365
        self = 0x1eb8e0 [NMModemOfono]
---Type <return> to continue, or q <return> to quit---
        error = 0x0
Python Exception <class 'TypeError'> iter() returned non-iterator of type '_iterator':
        properties = 0x1e4440
        value = 0x1dd368
        __func__ = "get_ofono_sim_properties_done"
#11 0xffffffff in () at /lib/arm-linux-gnueabihf/libdbus-1.so.3