Ye. The problem is the "file" part. My current status (maybe this helps jitspoe if he wants to fix it): The game will read in all pairs of the select widget correctly in menu.c's select_begin_list called from menu_from_file, but it wont set the read address for COM_Parse to the end of the pairs afterwards, so menu_from_file will parse all pairs again assuming it is parsing widget attributes. When it comes accros the "file" keyword, select_begin_file_list is called which then clears the widgets select_list because there are no files. Still, the widgets select_totalitems will be above 0, causing the game to read from select_list later when it wants to update the subwidgets the select consists of. There, you get the read error.
Possible fixes:
- make the game not modify the list if it already exists in select_begin_file_list (hacky)
- make the game only accept filedir instead of jsut relying on a strstr(token, "file") (hacky)
- make the game correctly continue parsing after the "end" of the pairs of the widget in menu_from_file (I would prefer this). I don't get how COM_Parse decides where to read though, so I can't really post a patch.