savecore panicked my system.
On a system running oi151_a7, after I panicked it with saving core dumps to rpool/dump enabled, I rebooted to find, to my surprise, that savecore reported "bad magic number: 0".
I ran zfs set volsize=128G rpool/dump and ran savecore again [mostly out of absentmindedness].
I was then greeted by a lovely backtrace and, yes, a panic.
At least it should be easy to trigger, I suppose - write a panic to your dump device, grow the dump device, run savecore, BOOM.
Assuming that on reboot it gives me back the dump in /var/crash [and not an infinite panic loop], I'll post a link or the dump itself here.