Thanks for your research. I spent a few hours trying to find the correct fix and came up with the following:
https://gist.github.com/1299877
This is what I got so far:
At first the template bgs are being initialized (1 template for each bg map type).
When initializing a bg on One and Zero we use MAX_BATTLEGROUND_BRACKETS for default m_BracketId which is used as a marker for us to see if that bg is a template or not.
When removing the bg templates, DeleteClientVisibleInstanceId is being called and tries, as you already found out, to erase an entry which an index out of the boundary of the array.
Now setting m_BracketId to BG_BRACKET_ID_FIRST as it is done in the master is probably not such a good idea as on master the bracket id actually is a pointer to dbc structure associated with bg copy, in One on the other hand this is the id itself. Meaning that 0 (BG_BRACKET_ID_FIRST) is a bracket on One but on master it actually is none, because first id is 1 in PvpDifficulty.dbc - not sure about that though. See this commit for more details: https://github.com/mangos/mangos/commit/b9712d36d2c285be14cf7bb9bd5cc1f4c9c58cf3
So yeah please try the patch at the top of this post, thanks