CMS with disabled CMSPLABRecordAlways crashes with SIGSEGV (product) and "Out of bounds value" assertion (fastdebug)

CMS run with -XX:-CMSPLABRecordAlways crashes with SIGSEGV with product bits and with following assertion
with fastdebug bits:
# Internal Error (/BUILD_AREA/jdk7/hotspot/src/share/vm/gc_implementation/concurrentMarkSweep/concurrentMarkSweepGeneration.cpp:5292), pid=32185, tid=2927975312
# Error: assert(surv->used_region().contains(cur_val),"Out of bounds value")
#
# JRE version: 7.0-b51
# Java VM: Java HotSpot(TM) Server VM (15.0-b03-fastdebug mixed mode linux-x86 )
# If you would like to submit a bug report, please visit:
# http://java.sun.com/webapps/bugreport/crash.jsp
#

--------------- T H R E A D ---------------

Current thread (0x08520400): VMThread [stack: 0xae7d5000,0xae856000] [id=32233]

Stack: [0xae7d5000,0xae856000], sp=0xae854b70, free space=1fef7a5cc96k
Native frames: (J=compiled Java code, j=interpreted, Vv=VM code, C=native code)
V [libjvm.so+0xad49c8];; VMError::report_and_die()+0x2f8
V [libjvm.so+0x499115];; report_assertion_failure(char const*, int, char const*)+0x65
V [libjvm.so+0x46a705];; CMSCollector::merge_survivor_plab_arrays(ContiguousSpace*)+0x375
V [libjvm.so+0x46aa0a];; CMSCollector::initialize_sequential_subtasks_for_young_gen_rescan(int)+0x1fa
V [libjvm.so+0x46ab1e];; CMSCollector::do_remark_parallel()+0x9e
V [libjvm.so+0x468ef4];; CMSCollector::checkpointRootsFinalWork(bool, bool, bool)+0x824
V [libjvm.so+0x46853c];; CMSCollector::checkpointRootsFinal(bool, bool, bool)+0xdc
V [libjvm.so+0x46dcdc];; CMSCollector::do_CMS_operation(CMSCollector::CMS_op_type)+0x18c
V [libjvm.so+0xad2691];; VM_CMS_Final_Remark::doit()+0xc1
V [libjvm.so+0xb13d51];; VM_Operation::evaluate()+0x91
V [libjvm.so+0xb12bbe];; VMThread::evaluate_operation(VM_Operation*)+0xbe
V [libjvm.so+0xb1304e];; VMThread::loop()+0x2be
V [libjvm.so+0xb12817];; VMThread::run()+0xd7
V [libjvm.so+0x8eaee2];; java_start(Thread*)+0x152
C [libpthread.so.0+0x545b]