content/history runs through all objectversions and calls eZContentObjectVersion::checkAccess for versionremove.

If checking User_Subtree/Subtree limitated policies the pathstring of the published Objectversion is compared to the SubtreeLimitation String. If that not grants access the parentnodes pathstring of the ObjectVersion is checked. If a parentobject of an old Version does not longer exists because it has been deleted and the Object itself has moved to another parent node eZ could not fetch the old parentNode and dies with fatal error.

I patched it for a customer. Patch is attached.

Steps to reproduce

Create Nodes under Home:
Folder A
Folder B
Folder C
Create a role author with login access an content/all functions
Assign the role to an user with Subtree Limitation to Folder A and B and C

author: Create an article under Folder B
author: Edit Version2 of article under Folder B
admin: move article to Folder C
admin: Delete Folder B
author: Edit article and go to version history.

eZ crashes because Folder B is no more available.