QJSEngine engine;
engine.evaluate( "var obj = { meth: function(a,b,c) {} }; obj.meth.call(1,2,3); ");

...
qv4functionobject.cpp line 380:

ReturnedValue FunctionPrototype::method_call(CallContext *ctx)
{
    Scope scope(ctx);

    FunctionObject *o = ctx->callData->thisObject.asFunctionObject();
    if (!o)
        return ctx->throwTypeError();

    ScopedCallData callData(scope, ctx->callData->argc ? ctx->callData->argc - 1 : 0);
    if (ctx->callData->argc) {
        std::copy(ctx->callData->args + 1,
                  ctx->callData->args + ctx->callData->argc, callData->args);

        ^^^^^^^^ crash here *
         
    }
    callData->thisObject = ctx->argument(0);
    return o->call(callData);
}