This is a bit pathological, but calling substitute with an empty set of rules causes the kernel to crash.
ex := A+B;
substitute(ex, $ $);
or
ex := A+B;
substitute(ex, ${ }$);
This is perhaps more a feature request than a bug report, as it might be nicer if we received the usual error message (i.e. "not a replacement rule or equality").