Hello,
today I found that 9.1 64 bit VM can be crashed by sending #isWeak or #isInFixedSpace to true or false (other primitives in that region might be affected as well).
Most likely these objects have object pointers that are not memory addresses, but the primitives don't check for that.
Since I did not switch to 9.2 yet, I did not test this with the 9.2 VM.
Cheers,
Hans-Martin
(update: this affects SmallIntegers, too, probably all immediate objects)