Ok, running it under valgrind with libdbusmenu 0.3.98-0ubuntu2:

"==19875==    at 0x46EB8D9: g_nullify_pointer (gutils.c:3543)
==19875==    by 0x46385A0: weak_refs_notify (gobject.c:2231)
==19875==    by 0x4695F48: g_datalist_id_set_data_full (gdataset.c:351)
==19875==    by 0x4638628: g_object_real_dispose (gobject.c:896)
==19875==    by 0x41DAFA0: gtk_object_dispose (gtkobject.c:426)
==19875==    by 0x42ECEA3: gtk_widget_dispose (gtkwidget.c:8771)
==19875==    by 0x463ABEE: g_object_run_dispose (gobject.c:945)
==19875==    by 0x41DBB4D: gtk_object_destroy (gtkobject.c:406)
==19875==    by 0x41BF848: gtk_menu_item_destroy (gtkmenuitem.c:566)
==19875==    by 0x418FD08: gtk_image_menu_item_destroy (gtkimagemenuitem.c:312)
==19875==    by 0x465348B: g_cclosure_marshal_VOID__VOID (gmarshal.c:79)
==19875==    by 0x4635CA6: g_type_class_meta_marshal (gclosure.c:878)
==19875==    by 0x4637351: g_closure_invoke (gclosure.c:767)
==19875==    by 0x4649A48: signal_emit_unlocked_R (gsignal.c:3368)
==19875==    by 0x4652B28: g_signal_emit_valist (gsignal.c:2983)
==19875==    by 0x4652CC1: g_signal_emit (gsignal.c:3040)
==19875==    by 0x41DAF90: gtk_object_dispose (gtkobject.c:421)
==19875==    by 0x42ECEA3: gtk_widget_dispose (gtkwidget.c:8771)
==19875==    by 0x41C080F: gtk_menu_item_dispose (gtkmenuitem.c:482)
==19875==    by 0x463ABEE: g_object_run_dispose (gobject.c:945)
==19875==    by 0x41DBB4D: gtk_object_destroy (gtkobject.c:406)
==19875==    by 0x42D9706: update_node (gtkuimanager.c:2802)
==19875==    by 0x42D969E: update_node (gtkuimanager.c:2785)
==19875==    by 0x42D969E: update_node (gtkuimanager.c:2785)
==19875==    by 0x42D969E: update_node (gtkuimanager.c:2785)
==19875==    by 0x42DD5A7: gtk_ui_manager_ensure_update (gtkuimanager.c:2827)
==19875==    by 0x804F009: ??? (in /usr/bin/bluetooth-applet)
==19875==    by 0x41B13FE: _gtk_marshal_VOID__BOXED_BOXED (gtkmarshalers.c:1311)
==19875==    by 0x4637351: g_closure_invoke (gclosure.c:767)
==19875==    by 0x464A047: signal_emit_unlocked_R (gsignal.c:3252)
==19875==    by 0x4652B28: g_signal_emit_valist (gsignal.c:2983)
==19875==    by 0x4652CC1: g_signal_emit (gsignal.c:3040)
==19875==    by 0x42A2457: gtk_tree_model_row_changed (gtktreemodel.c:1508)
==19875==    by 0x42B20FD: gtk_tree_store_set_valist (gtktreestore.c:1059)
==19875==    by 0x42B213E: gtk_tree_store_set (gtktreestore.c:1088)
==19875==    by 0x80539B5: ??? (in /usr/bin/bluetooth-applet)
==19875==    by 0x805921E: marshal_VOID__STRING_BOXED (in /usr/bin/bluetooth-applet)
==19875==    by 0x4461D43: ??? (in /usr/lib/libdbus-glib-1.so.2.1.0)
==19875==  Address 0x6e98934 is 12 bytes inside a block of size 20 free'd
==19875==    at 0x40259E0: free (vg_replace_malloc.c:366)
==19875==    by 0x46B9DE5: g_free (gmem.c:263)
==19875==    by 0x469585C: g_datalist_clear (gdataset.c:215)
==19875==    by 0x46390EF: g_object_finalize (gobject.c:902)
==19875==    by 0x49E0B92: dbusmenu_menuitem_finalize (menuitem.c:346)
==19875==    by 0x463896B: g_object_unref (gobject.c:2734)
==19875==    by 0x49E23BF: dbusmenu_menuitem_child_delete (menuitem.c:751)
==19875==    by 0x49D8F08: widget_notify_cb (parser.c:795)
==19875==    by 0x4653E47: g_cclosure_marshal_VOID__PARAM (gmarshal.c:533)
==19875==    by 0x4637351: g_closure_invoke (gclosure.c:767)
==19875==    by 0x464A047: signal_emit_unlocked_R (gsignal.c:3252)
==19875==    by 0x4652B28: g_signal_emit_valist (gsignal.c:2983)
==19875==    by 0x4652CC1: g_signal_emit (gsignal.c:3040)
==19875==    by 0x46390C0: g_object_dispatch_properties_changed (gobject.c:925)
==19875==    by 0x46383CE: g_object_notify_dispatcher (gobject.c:330)
==19875==    by 0x463C1E0: g_object_thaw_notify (gobjectnotifyqueue.c:132)
==19875==    by 0x42E9C2C: gtk_widget_unparent (gtkwidget.c:3129)
==19875==    by 0x41C3899: gtk_menu_shell_remove (gtkmenushell.c:1146)
==19875==    by 0x41B5A2F: gtk_menu_remove (gtkmenu.c:1312)
==19875==    by 0x4654087: g_cclosure_marshal_VOID__OBJECT (gmarshal.c:638)
==19875==    by 0x4635CA6: g_type_class_meta_marshal (gclosure.c:878)
==19875==    by 0x4637351: g_closure_invoke (gclosure.c:767)
==19875==    by 0x46497B5: signal_emit_unlocked_R (gsignal.c:3182)
==19875==    by 0x4652B28: g_signal_emit_valist (gsignal.c:2983)
==19875==    by 0x4652CC1: g_signal_emit (gsignal.c:3040)
==19875==    by 0x4122C90: gtk_container_remove (gtkcontainer.c:1260)
==19875==    by 0x42ECE7C: gtk_widget_dispose (gtkwidget.c:8763)
==19875==    by 0x41C080F: gtk_menu_item_dispose (gtkmenuitem.c:482)
==19875==    by 0x463ABEE: g_object_run_dispose (gobject.c:945)
==19875==    by 0x41DBB4D: gtk_object_destroy (gtkobject.c:406)
==19875==    by 0x42D9706: update_node (gtkuimanager.c:2802)
==19875==    by 0x42D969E: update_node (gtkuimanager.c:2785)
==19875==    by 0x42D969E: update_node (gtkuimanager.c:2785)
==19875==    by 0x42D969E: update_node (gtkuimanager.c:2785)
==19875==    by 0x42DD5A7: gtk_ui_manager_ensure_update (gtkuimanager.c:2827)
==19875==    by 0x804F009: ??? (in /usr/bin/bluetooth-applet)
==19875==    by 0x41B13FE: _gtk_marshal_VOID__BOXED_BOXED (gtkmarshalers.c:1311)
==19875==    by 0x4637351: g_closure_invoke (gclosure.c:767)"