Don't have consistently reproducible test case but it happens with concurrent updates, removes and iterations over snapshots. It seems that sometimes height + 1 is not enough to accommodate full tree branch.

java.lang.ArrayIndexOutOfBoundsException: 5
at edu.stanford.ppl.concurrent.SnapTreeMap$AbstractIter.pushFirst(SnapTreeMap.java:2062)
at edu.stanford.ppl.concurrent.SnapTreeMap$AbstractIter.advance(SnapTreeMap.java:2102)
at edu.stanford.ppl.concurrent.SnapTreeMap$AbstractIter.nextNode(SnapTreeMap.java:2130)
at edu.stanford.ppl.concurrent.SnapTreeMap$KeyIter.next(SnapTreeMap.java:1976)