Instant kernel crash when using += on SparseArray with repeated entries

Bug introduced in 5.2 and fixed in 10.1.0

Not sure if this is known behavior or not, but the following two lines produce an instant kernel crash (I'm using Mathematica 10.0.1 Windows 64-bit):

A = SparseArray[{}, {3, 3}];
A[[1, {1, 1}]] += 1

This is just a minor modification of the following lines:

A = SparseArray[{}, {3, 3}];
A[[1, {1, 2}]] += 1

which are designed to increment entries {1,1} and {1,2} of A by one. I would have expected the crash-inducing example to increment the {1,1} entry by two. Instead, I get screams of death.

Any clues as to what is going on here?

This slight variation produces a more apparent crash in 7.0.1:

A = SparseArray[{}, {3, 3}];
A[[1, {1, 2, 3, 1, 1}]] += 1
• Crashes 9.0.1 as well. And 8.0.4. But not 7.0.1! – Oleksandr R. Jan 15 '15 at 1:41
• Reproduced with 10.0.2 on OS X. – Szabolcs Jan 15 '15 at 1:43
• obviously a crash is unacceptable, but those don't look like legal operations. What result are you expecting? – george2079 Jan 15 '15 at 3:25
• @george2079: The syntax A[[k, list]] += 1 where k is a positive integer and list is a list increments all entries with indices $(k,m)\mid m\in\text{list}$ by one. This is a convenient one-line syntax for a multiple update within the $k$th row of a sparse matrix. Unfortunately, for some reason whenever list has a repeated element the kernel crashes. Of course, one possible workaround would be to simply construct a Do loop and iterate the sparse row update over the elements of list, but the aforementioned syntax makes things easier. – DumpsterDoofus Jan 15 '15 at 14:06
• @Mr.Wizard yes, the array is modified correctly. However, this is clearly a buggy area, as the code from the other question and the modified version you provide here both crash the kernel. – Oleksandr R. Feb 3 '15 at 9:26