In general terms, that valgrind output shows that the calling of a sub while running code via call_after() (which requires a new CXt_SUB context sub to be pushed) grows the context stack (by reallocating it). Sometime later when exiting a use/require, the Cxt_EVAL frame is accessed using the old context stack address (the smaller stack that was freed when a larger one was allocated). So maybe something is holding on to a context stack pointer when it shouldn't - either in core or XS.

Dave.