treehash must always been checked before used! Reported on irc by sebastian_k and investigated by sergey, thanks!