Right then.
Since I don't know how to fix the precompiled libraries, I've simply made my own versions of malloc/free/realloc from the avr-libc-1.7.1 source.
This can be downloaded from:
http://gammon.com.au/Arduino/mymalloc.c
Just incorporate that into your project (make a new tab in the IDE called mymalloc.c - NOT .cpp) and paste the file into it.
Then, add this to the start of your project:
extern "C" {
void * mymalloc(size_t len);
void myfree(void *p);
void * myrealloc(void *ptr, size_t len);
}
Now change (or #define) malloc to mymalloc and so on. Then the test runs with everything going back to normal at the end.
Possibly all that needs changing is free, since I think that is the thing with the bug.
A caveat is that things like the String library will probably still pull in the old malloc/free. There is probably a smarter way of achieving this.