I can also reproduce the same crash scenario with this command:
curl -v -H 'Content-Type: application/json' -H 'Call-ID: abc12' -d '{"jsonrpc": "2.0", "method": "core.version", "id": "0deadb33f"}' 'http://172.30.110.4:5060/csrp_rpc/'
This one is a bit different than the request I was sending when initially reporting the problem.
1) It has a shorter 'id' GUID.
2) It has a Call-ID header.
3) It has a Content-Type: application/json.
So, I suppose I can say that it's not the length of the 'id' field nor the lack of Call-ID that causes the crash.