/bin/mail which comes with the security upgraded mailx-8.1.1-16 for RH 5.2 seems to open the /var/spool/mail/$USER readonly, and when it tries to delete or change the flag on a message, it dumpes core. Believe it or not, people still use /bin/mail as reader.
I straced mailx on a 5.2 system with all applicable updates. mailx was at 8.1.1-16. /var/spool/mail/xxx was indeed opened O_RDONLY; however it was closed and reopened O_WRONLY | O_TRUNC. Upon supplying d1 to the prompt the 1st and only message was deleted. Can't reproduce this bug.