This bug is sometimes difficult to reproduce, but at other times is extremely consistent. It seems to depend on the number of documents that the user has in their Loose Leaf, and also may depend on the content of the exported document.

To repro (rough steps):

1. Import moderately long PDF (at least 20 pages) about 10 times so that at least 10 documents exist
2. Export a document that has > 20 pages

The error message will be some variation of "cannot realloc pointer that not allocated" or "attempting to free pointer that was not allocated with malloc"

It seems to me that the pointer in the error message is a red herring, and what's really happening is the heap is getting corrupted, which is messing up a pointer that's in use elsewhere in the app. The stack trace is not consistent, and often appears in plist read/write during page state loading and unloading.