Original xpdf 3.03 works fine, the problem is that debian's xpdf links against libpoppler while retaining much duplicate code. In particular, both xpdf and libpoppler have a GlobalParams class and a globalParams global variable, and the two get confused at runtime: libpoppler's GlobalParams constructor never gets called, the getProfileCommands() method where the crash occurs, which only exists in libpoppler, is called on an instance of xpdf's GlobalParams class (which is stored in xpdf's globalParams variable while libpoppler's remains NULL).
It's a puzzle to me how this ever managed to *not* crash...