Based on your information I make some experiments.
I found how to fix problem on my S95. But have no idea why it works. 
Test enviroment #1 - just right as it was now. It always crash if try to popup menu first time while led blinking right after shoot with built-in RAW.
Test enviroment #2 - move gui_module_menu_load() back to gui_init() to crash on startup but avoid influence of how my finger speed.
Max valuable depth of MODULE dir is I:\CHDK\MODULES\GAMES\NEW\DEEP\TEST\ depth (depth could have matter because currently module_menu recursively open each of this dir without closing previous. Probably this should be rewrited, this probably increasy slightly memory fragmentation but decrease risk to exhaust resources).
Results:
Enviroment #1 - crash always before, crash never after
Enviroment #2 - crash with 80% chance with my current SD content, crash never after fix.
How did I fix.
Code below is added in the begining of safe_opendir(). This function is only valid way to use opendir inside module. So this will work for all other modules too.
int fd = open(name, O_RDONLY, 0777);
if ( fd <= 0 )
return 0;
close(fd);
UPD: forget to say. Module menu successfully resolve modules in path above. So looks like this fix not just return fail but wait until resources become available.
Your 'fix' is only masking the problem by changing the timing.
As discussed in this thread
http://chdk.setepontos.com/index.php?topic=6179.0, the problem happens when CHDK and the Canon firmware are both opening and closing files at the same time.
The 'Open' function adds the file handle to an array after the file is opened. The 'Close' function removes the file handle after the file is closed. But there is no multi-tasking protection around these functions.
If the Canon firmware is closing a file and CHDK opens a new file before 'Close' has removed the handle from the array then CHDK can get back the same file handle just closed. The call to 'Open' from CHDK asserts because it finds the file handle already in the array.
The current fix is to use the 'open' firmware function instead of 'Open' - this function does not add the file handle to the array. As reyalp has pointed out 'opendir' calls 'Open' internally so the CHDK hack won't help here.
So your fix might work at the moment on your camera; but there is no guarantee it will work on any others, or that it will always work on yours. For example, the number of images on the card affects the startup timing and thus the chance of the problem occurring.
The other issue that needs clarification is the 32 character path length limit on some cameras.
This limit means that you cannot open a file or directory where the path name + file name is more than 32 characters. So for example A/CHDK/MODULES/mastmind.flt will work (27 chars); but A/CHDK/MODULES/GAMES/mastmind.flt will fail (33 chars).
Phil.
