Sorry, I didn't get notified of updates here till now.
If you pass NULL then yes it crashes. But also if you pass in the root bone, because it has no parent.
If parent is NULL then it calls spBone_localToWorld with the NULL, which immediately crashes inside.
I think it probably should be like worldToParent two functions above. if (self->parent == NULL) {
instead of if (self->parent != NULL) {
But maybe this is the intention of the API somehow?