Imagine the following setup:
GLuint rb=0;
glGenRenderbuffersEXT(1, &rb);
glBindRenderbufferEXT(GL_RENDERBUFFER_EXT, rb);
glRenderbufferStorageEXT(GL_RENDERBUFFER_EXT, GL_RGBA8, 1024, 768);
m_fbo=0;
glGenFramebuffersEXT(1, &m_fbo);
glBindFramebufferEXT(GL_FRAMEBUFFER_EXT, m_fbo);
glFramebufferRenderbufferEXT(GL_FRAMEBUFFER_EXT, GL_COLOR_ATTACHMENT0_EXT, GL_RENDERBUFFER_EXT, rb);
glDrawBuffer(GL_COLOR_ATTACHMENT1_EXT); //notice, there is nothing attached to GL_COLOR_ATTACHMENT1_EXT!
glReadBuffer(GL_COLOR_ATTACHMENT1_EXT);
GLint error=glGetError();
assert(error==GL_NO_ERROR);
assert(glCheckFramebufferStatusEXT(GL_FRAMEBUFFER_EXT)==GL_FRAMEBUFFER_COMPLETE_EXT);
interestingly, neither glDrawBuffer() nor glReadBuffer() generate an GL error and glCheckFramebufferStatusEXT() returns GL_FRAMEBUFFER_COMPLETE_EXT.
Rendering to or blitting from the FBO now crashs the driver with a NULL-pointer exception.
Tested on GTX470, 266.58 drivers, Win7 x64