On github, seanbcos correctly pointed out that Curl_follow() only "takes ownership" of the passed in newurl pointer if it succeeds. If it returns error, it is still left to the caller to free the memory and after a recent commit that isn't always done. We better fix...
https://github.com/bagder/curl/commit/18fdd46a4b7bda95e5100248015582d63c0031aa#commitcomment-2259930
I'm fairly certain you can close this bug.
My analysis: http://i.imgur.com/W7AEBP6.png
Actually, looks like I have an older file in front of me, will check newer. Sorry about that.
Here's your fix. It simply moves the NULL assignment within the success check, from outside of it, to ensure it properly tells the if below when to free.
I moved the use right above it which did not leak memory into a nested if, as the second if would never occur if the first didn't, and would probably optimize into my change anyway, but this way it's clearer that there is no memory leak above either.
Thanks Nach, with this analyze and some further discussions in IRC and the fact that I cannot trigger any leak with runtests.pl's torture tests, we hereby consider this bug fixed and closde.