There is a chart (unfortunately without source) going around comparing different SSL implementations. In this chart there are situations in which PolarSSL accepts a certificate when it should not.
I quit gradschool a month after publishing this so can't comment on what Suman is currently working on, but it looks like it is still mostly my code for generation.
I didn't write the script for using polarSSL but I wrote most the other ones,the testing harness, cert generation and cert crawling, and I can say that polarSSL loved to crash on my weird certs. I almost wanted to remove them from the tested list for being so unreliable.
https://www.cs.utexas.edu/~shmat/index.html#pub
It's the first one, Frankencert.