Okay, apparently the problem was caused by a call to GetReverseFactionCon() for a non-player entity.
Fixed with the following code change:
File: mob.cpp, Line 817 - mob::FillSpawnStruct()
	Code:
	  if (ForWho && ForWho->IsClient() && RuleB(World, FlagHostileNPCs))
  {
    switch (ForWho->CastToClient()->GetReverseFactionCon(this))
    {
      case FACTION_THREATENLY:
      case FACTION_SCOWLS:
        memcpy_s(ns->spawn.lastName, sizeof(ns->spawn.lastName), "Hostile", 8);
        break;
    }
  }
 On an unrelated note, I found that if you have a pet, you can aggro hostile NPCs even with the GM flag on. LOL.
It's hard to tell whether the pet's aggroing the NPC or the NPC is aggroing on the pet.