Found via fuzzing.

Steps to reproduce:

1. run the server example (cargo run --example=server)
2. feed it the bad input (cat crash | nc localhost 8080)

crash is

GET https://example.com HTTP/1.1
Host:ȃ

and as base64 (to avoid encoding issues)

R0VUIGh0dHBzOi8vZXhhbXBsZS5jb20gSFRUUC8xLjEKSG9zdDrIgw0KDQo=

Full backtrace is long, I put it in the below gist.

https://gist.github.com/5225225/dd931721233609b6e6ce39d0705b0119