The command

/summon Villager ~ ~ ~ {Offers:{Recipes:[{buy:{id:1},sell:{}}]}}

will crash any client that attempts to interact with the villager and place an item into the "buy" slot. This allows servers to crash clients by sending bad villager data.

I assume this is due to either a mishandled null or a an issue with a draw call.

The relevant client crash report: https://gist.github.com/drXor/14433dbbf43705c46e36