A crash occured after pushing buffers and changing mpegtsmux state to NULL/READ and then back to PLAYING/PAUSED. The crash was caused by holding a dangling pointer in the MpegTsMux program table. Additionally stream headers were leaked when resetting the element: mux->streamheader set to NULL in mpegtsmux_reset() before it's released later in the same function. Added a unit test: test_multiple_state_change https://bugzilla.gnome.org/show_bug.cgi?id=689107