In shared/strv.c, invalid pointers are used on error paths. k cannot point before r in strv_copy(), strv_append(), strv_env_merge(), strv_env_set() because k must point within the allocated object (or one element past it). The compiler is free to assume that k is never less than r. I have not checked whether GCC makes this optimization, but future versions might in any case.
In systemd git all these loops are now replaced by simple strv_free() which should fix the issue.
systemd-195-10.fc18 has been submitted as an update for Fedora 18. https://admin.fedoraproject.org/updates/systemd-195-10.fc18
Package systemd-195-10.fc18: * should fix your issue, * was pushed to the Fedora 18 testing repository, * should be available at your local mirror within two days. Update it with: # su -c 'yum update --enablerepo=updates-testing systemd-195-10.fc18' as soon as you are able to. Please go to the following url: https://admin.fedoraproject.org/updates/FEDORA-2012-19811/systemd-195-10.fc18 then log in and leave karma (feedback).
systemd-195-10.fc18 has been pushed to the Fedora 18 stable repository. If problems still persist, please make note of it in this bug report.