Does everything happen in motion_detector.c file and md_detect_motion(void) function or bug can be in other wrappers?
The romlog tells you the crash happened in PhySw task (also referred to as kbd_task etc in CHDK)
Since it's an exception, the registers give you the exact address where exception occurred: PC (R15) = 0x03C683FA in this case. That looks like it's in CHDK code, since it's a RAM address, not ROM and not the relativity low addresses of the canon code that's copied to RAM in newer cameras.
However, without the original files from the build, it's hard to figure out which line of code that corresponds to. If you can make you own build of CHDK, that's the next step. You should use the 1.2 trunk rather than 1.1, since it will be easier to debug modules. Be sure to save the core/main.bin.dump and modules/.o/*.elf files from your build.
Install your new build and turn on "module logging" in the misc->modules menu. Run your build until the crash happens again. Save the new ROMLOG, and look up the PC address in main.dump, or if it isn't there, figure out which module it is in from modules.log, disassemble the corresponding ELF as described in
http://chdk.wikia.com/wiki/Debugging#Debugging_modules and look up the address there.
If this seems too complicated, I can provide you with a build to run.
