I just found a file that causes the crash, and it seems to be an issue with missing delimiters. The ID3v2 tag TIT2 (title) contained the correct title, but no closing \0 - the length field of the tag however was correct.
The ID3v2 documentation says a tag has a 4-byte header ('TIT2'), followed by a 4-byte size (0x27), 2-byte flags (0x00) followed by the contents (0x01, 0xFF, 0xFE, 'D', 0x00, 'o', 0x00, 'u', 0x00, 'b', 0x00, 't', 0x00, 'f', 0x00, 'u', 0x00, 'l', 0x00, ' ', 0x00, 'E', 0x00, 'x', 0x00, 'i', 0x00, 's', 0x00, 't', 0x00, 'e', 0x00, 'n', 0x00, 'c', 0x00, 'e', 0x00) - the song is "Doubtful Existence" by Dark Age.
The 0x01 in the beginning indicates the text is "UTF-16 [UTF-16] encoded Unicode [UNICODE] with BOM."
However, the specification also says "Terminated with $00 00.", which is not the case here.
I'd say both are at fault; my tag for not being delimited, and mIRC 7.1 for not reading/using the length flag (note that 6.35 handled this correctly, altho I think it was only by chance. This might be abused at some point with specifically crafted mp3 files used for exploitation; or simply crash if someone didnt have the terminating \0).
The interresting thing is that it also crashes with $mp3(%file).title - which, according to /help $sound, reads the ID3v1 tag - which is fixed size and correct (altho also not delimited and filled with spaces, guess MMJB had a few loose screws when tagging this).
