Hello.
The loop that parses strings from STRINGLIST in field.c on line 294 depends only on length parameter and on function id3_utf16_deserialize() to move the pointer *ptr by length or more in case of UTF16. However, in several files with UTF16 ID3 tags on my PC the *ptr pointer was moved by one byte less. Following calls of id3_utf16_deserialize() didn't move pointer at all so the loop would continue forever or until field->stringlist.strings filled whole memory. I'm not sure if it's fault of invalid ID3 tags but the library should certainly recover from it.
Because the last byte is always string terminator I fixed it with horrible hack I attached. I have no idea if it's correct but it avoided the infinite loop so far.
I'd love to privately send you test C source and test file with ID3 tags if you're interested.
I'm sorry for my dirty half-analysis. I already gave up on MPD which was the only reason why I was debugging this problem.