I downloaded a 1.3.5 snapshot, and this bug seems to be fixed (only a single malloc()).. I did a bugsearch before I logged it, but apparently I missed it (or it wasn't logged).