iPad2 another driver crash

iPad2Crash2.c

/*
Crashes iPad 2, iOS 4.3. Thread 0 Crashed:
0   IMGSGX543GLDriver 0x30c28b92 UpdateShaderParams + 14
1   IMGSGX543GLDriver 0x30c29266 glrUpdateCtxSysFragmentProgram + 1406
2   IMGSGX543GLDriver 0x30c21970 glrUpdateFragmentProgramInline + 292
3   IMGSGX543GLDriver 0x30c21e58 glrLoadCurrentPipelinePrograms + 576
4   IMGSGX543GLDriver 0x30c2a54c gldUpdateDispatch + 856
5   GLEngine          0x35ca1bac gleDoDrawDispatchCore + 252
6   GLEngine          0x35c285cc glDrawArrays_IMM_Exec + 208
7   OpenGLES          0x30bd2edc glDrawArrays + 28
<...>

Only crashes if the calling code sets up uniFogColor uniform value.

See "DOES NOT CRASH" comments below on how massaging the code makes it not crash.
*/


#ifdef VERTEX
uniform mat4 glstate_matrix_mvp;
attribute vec4 _glesVertex;
varying highp vec2 varUV;
varying lowp float varFog;
void main ()
{
	gl_Position = glstate_matrix_mvp * _glesVertex;
	varFog = 0.5; // replaced real fog calculation with a dummy
	varUV = _glesVertex.xy; // replaced real UV with a dummy
}
#endif


#ifdef FRAGMENT

uniform sampler2D texMain;
uniform sampler2D texLightmap;
uniform lowp vec4 uniColor;
uniform lowp vec4 uniFogColor;

varying highp vec2 varUV;
varying lowp float varFog;

void main ()
{
	lowp vec4 t = texture2D (texMain, varUV) * uniColor;
	lowp vec4 c;

	// crashes!
	c.xyz = t.xyz * texture2D (texLightmap, varUV).xyz;
	c.w = t.w;
	gl_FragColor = c;
	gl_FragColor.rgb = mix (uniFogColor.rgb, gl_FragColor.rgb, varFog);

	// WOULD NOT CRASH A (write to local var first instead of gl_FragColor)
	/*
	c.xyz = t.xyz * texture2D (texLightmap, varUV).xyz;
	c.w = t.w;
	lowp vec4 o = c;
	o.rgb = mix (uniFogColor.rgb, o.rgb, varFog);
	gl_FragColor = o;
	*/

	// WOULD NOT CRASH B (but different behavior, writes zero to alpha)
	/*
	c.xyz = t.xyz * texture2D (texLightmap, varUV).xyz;
	c.w = 0.0;
	gl_FragColor = c;
	gl_FragColor.rgb = mix (uniFogColor.rgb, gl_FragColor.rgb, varFog);
	*/

	// WOULD NOT CRASH C (but different behavior, writes texture values to alpha)
	/*
	c = t * texture2D (texLightmap, varUV);
	gl_FragColor = c;
	gl_FragColor.rgb = mix (uniFogColor.rgb, gl_FragColor.rgb, varFog);
	*/
}
#endif