Segfault

I'm getting a segfault when registering a object with a method that returns a handle to it's self. The following code reproduces the crash:

#include <angelscript.h>
#include <stdio.h>

class IManaged {
    public:
        virtual void addRef() = 0;
        virtual void Release() = 0;
};

class Test : public IManaged {
    public:
        void addRef() {

        }

        void Release() {

        }

        Test &Foo() {
            return *this;
        }
};

Test *pTest;

int main() {
    asIScriptEngine *pEngine = asCreateScriptEngine(ANGELSCRIPT_VERSION);
    asIScriptModule *Mod     = pEngine->GetModule(0, asGM_ALWAYS_CREATE);

    pTest = new Test();

    pEngine->RegisterObjectType("Test", 0, asOBJ_REF);
    pEngine->RegisterObjectBehaviour("Test", asBEHAVE_ADDREF, "void f()", asMETHOD(Test, addRef), asCALL_THISCALL);
    pEngine->RegisterObjectBehaviour("Test", asBEHAVE_RELEASE, "void f()", asMETHOD(Test, Release), asCALL_THISCALL);
    pEngine->RegisterObjectMethod("Test", "Test &Foo()", asMETHOD(Test, Foo), asCALL_THISCALL);
    pEngine->RegisterGlobalProperty("Test @pTest", pTest);

    const char *Script = "void main() { pTest.Foo(); }";

    Mod->AddScriptSection("script", Script);
    Mod->Build();

    asIScriptContext *Ctx = pEngine->CreateContext();
    asIScriptFunction *Func = Mod->GetFunctionByDecl("void main()");

    Ctx->Prepare(Func);
    Ctx->Execute();

    return 0;
}

here is the backtrace:

#0  0x0000000000412682 in asCScriptEngine::CallObjectMethod (this=0x737010,
    obj=0x4c5e30 <vtable for Test+16>, i=0x7400f0, s=0x740150)
    at ../../source/as_scriptengine.cpp:3382
#1  0x0000000000412574 in asCScriptEngine::CallObjectMethod (this=0x737010,
    obj=0x4c5e30 <vtable for Test+16>, func=31)
    at ../../source/as_scriptengine.cpp:3354
#2  0x0000000000490b73 in asCContext::ExecuteNext (this=0x740ae0)
    at ../../source/as_context.cpp:3739
#3  0x00000000004896af in asCContext::Execute (this=0x740ae0)
    at ../../source/as_context.cpp:1155
#4  0x00000000004026c7 in main () at test.cpp:48

This happends on both 32 and 64-bit builds with GCC 4.7.2 (Linux)

Thanks,

Dave