xscl and yscl , used by difilt(), are of size PL_MAXPOLY whereas their contents can be of any size, (see line 534 of plcore) causing invalid memory access and code corruption.
This is most visible when drawing a filled area of a shape of size > PL_MAXPOLY on the postscript driver, that triggers difilt() due to its (IMHO too complicated) coordinate conversions.