The command
/summon Villager ~ ~ ~ {Offers:{Recipes:[{buy:{id:1},sell:{}}]}}
will crash any client that attempts to interact with the villager and place an item into the "buy" slot. This allows servers to crash clients by sending bad villager data.
I assume this is due to either a mishandled null or a an issue with a draw call.
The relevant client crash report: https://gist.github.com/drXor/14433dbbf43705c46e36
Comments

I got this error on a server client:
[17:13:36 ERROR]: Failed to save chunk
e: Saving entity NBT
at rr.e(SourceFile:1322) ~[minecraft_server.jar:?]
at rr.d(SourceFile:1263) ~[minecraft_server.jar:?]
at ass.a(SourceFile:216) ~[minecraft_server.jar:?]
at ass.a(SourceFile:102) [minecraft_server.jar:?]
at lo.b(SourceFile:147) [minecraft_server.jar:?]
at lo.a(SourceFile:166) [minecraft_server.jar:?]
at lp.a(SourceFile:883) [minecraft_server.jar:?]
at net.minecraft.server.MinecraftServer.a(SourceFile:371) [minecraft_server.jar:?]
at net.minecraft.server.MinecraftServer.C(SourceFile:571) [minecraft_server.jar:?]
at net.minecraft.server.MinecraftServer.run(SourceFile:457) [minecraft_server.jar:?]
at java.lang.Thread.run(Unknown Source) [?:1.8.0_71]
Caused by: java.lang.NullPointerException
at ahg.k(SourceFile:130) ~[minecraft_server.jar:?]
at ahh.a(SourceFile:132) ~[minecraft_server.jar:?]
at ze.b(SourceFile:258) ~[minecraft_server.jar:?]
at rr.e(SourceFile:1304) ~[minecraft_server.jar:?]
at rr.c(SourceFile:1253) ~[minecraft_server.jar:?]
at rr.e(SourceFile:1310) ~[minecraft_server.jar:?]
... 10 more
And now I see this, I think it has to do with it, altough I diidn't give tthe villager no items to sell but misspelled the id of the item (id:"minecraft:salmon").
I think this is fixed (somewhere between 15w44b and 1.8.8), it didn't crash me anymore. However, when I ran
on the villager, I got
And this appeared in the console: