[tene]

It's usually not calling free() on the same variable within a single function, although that can sometimes happen. The most common case, I expect, is when two separate data structures both have pointers to the same object and believe they own it, then later end up calling free on the same address at different times.