If you're running a release build with asserts turned off, and the connection uses SPDY, and the length of the domain name of the host is in the valid range of 245-253 bytes, then it looks like you can overwrite the stack at line 158 of xforward.c, at
memcpy(frame + 12, client->remote.host, client->remote.host_len);