The plug-in already makes a copy of the cinfo struct for asynchronous
save, but it seems that somewhere inside cinfo, a pointer points to
another region in this struct. So, everything is copied as-is, and
the pointer ends up pointing to somewhere in the save_image() stack
which is gone when that function returns.