Yep, I got rid of a dynamic_cast by replacing it with a new asKeyframeMotion() virtual method, but I forgot to test for the pointer returned by a findMotion() (which may be NULL, in the event that an animation is removed from an avatar before it finishes downloading), before calling that method with that pointer... Silly me !
I did not encounter this crash myself, but it is probably because I got a fast connection (the slower your connection, the more likely an animation may finish playing before it can be fully downloaded).
Fixed for next release.
If you compile the viewer yourself, you may, in the mean time, restore the dynamic_cast (simpler than the full fix) by replacing lines 2559 to 2562 of indra/llcharacter/llkeyframemotion.cpp with: