How can I get GDB to tell me what address caused a segfault?

With GDB 7 and higher, you can examine the $_siginfo structure that is filled out when the signal occurs, and determine the faulting address:

(gdb) p $_siginfo._sifields._sigfault.si_addr

If it shows (void *) 0x0 (or a small number) then you have a NULL pointer dereference.