This seems to be the same bug as in ZombieBufPool: when zombifying, ZombieFuncPool's datahandler is set to a DataHandlerWrapper rather than ZombieHandler, which causes the length of path-indices vector to be different from length of path vector. Same thing appears in ZombiSumFunc and ZombieMMenz as well. Not sure if replacing them with ZombieHandler will cause an error.
Anonymous
Checked in 3311 where I replace the DataHandlerWrapper with a ZombieHandler. It clears the unit and regression tests, but I don't have the test case you've reported.
Fixed. Zombie Handler should have been used instead of DataHandlerWrapper.