[next] SIGSEGV/Z_Free crashes and garbage-drawing when loading CTF patches

Basic steps to reproduce:

1. Start a CTF netgame
2. exitlevel
3. Load a new CTF level

You can sometimes play with the number of level reloads you do before an exitlevel to get differing results, including warped flag patches and Z_Free: wrong id errors. Attached is a crash log with several crashes I achieved, all from reloading/exiting CTF levels. The first three are SIGSEGVs, the last is a Z_Free wrong id error.

This does not seem to happen in 2.2.8.

crash-log.txt