(gdb) run call.exe
Starting program: /usr/local/bin/ilrun call.exe
[Thread debugging using libthread_db enabled]
[New Thread 1073879904 (LWP 1429)]
First time
Proceed to emitter
Proceed to callback
Second time
Proceed to emitter

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 1073879904 (LWP 1429)]
0x0000ffe9 in ?? ()
(gdb) bt
#0  0x0000ffe9 in ?? ()
#1  0x405fb675 in EmitCallback () from /home/ilyak/bug/libcall.so
#2  0x080d78d3 in ffi_call_SYSV () at src/x86/sysv.S:59
#3  0x080d7899 in ffi_raw_call (cif=0x0, fn=0x405fb658 <EmitCallback>,
    rvalue=0x13, fake_avalue=0xffe9) at src/x86/ffi.c:515
#4  0x08094b8e in _ILCVMInterpreter (thread=0x8157e70) at cvm_call.c:889
#5  0x0804c3d8 in _ILCallMethod (thread=0x8157e70, method=0x40296578,
    unpack=0x804c25c <_ILCallUnpackVResult>, result=0xbffff710, isCtor=0,
    _this=0x0, pack=0x804bfa4 <_ILCallPackVParams>, userData=0xbffff720)
    at call.c:706
#6  0x0804c6ad in ILExecThreadCallV (thread=0x8157e70, method=0x40296578,
    result=0xbffff710, args=0xbffff720) at call.c:928
#7  0x0804bb6c in main (argc=2, argv=0xbffff7d4) at ilrun.c:494


Not quite a NULL, while sure this is not a real pointer :)

I added WriteLines for cbi.callback in the code and this is what it threw up.

First time
call+CallbackDelegate
Proceed to emitter
Proceed to callback
Second time
Uncaught exception: System.NullReferenceException: The value 'null' was found where an instance of an object was required

So you're getting a C# null for the delegate there.