The next debug line in a message that doesn't cause local_scan to crash
would be something like:
SA: Debug9: Did not find X-SA-Exim- in Received: from h220-21.tijo.pl
([78.133.220.21])

------------------------------------------------------------------------
Other information:
Linux mail.addicts.nl 2.6.29-xen-r4 #8 SMP Wed Sep 16 13:13:23 CEST 2009
x86_64 AMD Phenom(tm) II X4 945 Processor AuthenticAMD GNU/Linux

exim 4.69
sa-exim 4.2.1

Seems to me that local_scan crashes in (or just before) the logic that
looks for the X-SA-Exim- headers.
I have looked at the code, but can't find anything wrong with it.
Any help will be greatly appreciated.
Martin