E.memoryArea not working on ESP8266 (due to char-iterator ?)

I can confirm the peek stuff above works, however I get a reset with E.memoryArea trying to read the Esp8266 flash:

>esp8266 = require("ESP8266");
=function () { [native code] }
>var base=esp8266.getFreeFlash()[2].area;
=1011712
>E.memoryArea(base,10);
="
 ets Jan  8 2013,rst cause:2, boot mode:(3,6)
load 0x40100000, len 1396, room 16
tail 4
chksum 0x89
load 0x3ffe8000, len 776, room 4
tail 4
chksum 0xe8
load 0x3ffe8308, len 540, room 4
tail 8
chksum 0xc0
csum 0xc0
2nd boot version : 1.4(b1)
  SPI Speed      : 80MHz
  SPI Mode       : DIO
  SPI Flash Size & Map: 32Mbit(512KB+512KB)
jump to run user1 @ 1000
don't use rtc mem data

>process.env
={
  "VERSION": "1v84",
  "BUILD_DATE": "Feb 12 2016",
  "BUILD_TIME": "08:57:53",
  "GIT_COMMIT": "8d4df7829bc7ebc8bc701c0f04e2fc645b99bd02",
  "BOARD": "ESP8266_BOARD",
  "CHIP": "ESP8266",
  "CHIP_FAMILY": "ESP8266",
  "FLASH": 0, "RAM": 81920,
  "SERIAL": "5ccf7f00-d975",
  "CONSOLE": "Serial1",
  "EXPORTS": { "jsvLock": 1075994728, "jsvLockAgainSafe": 1075994712, "jsvUnLock": 1075981000, "jsvSkipName": 1075970120,
    "jsvMathsOp": 1075935700, "jsvMathsOpSkipNames": 1075960212, "jsvNewFromFloat": 1076000164, "jsvNewFromInteger": 1076000232, "jsvNewFromString": 1075999068,
    "jsvNewFromBool": 1076000200, "jsvGetFloat": 1075970588, "jsvGetInteger": 1075971844, "jsvGetBool": 1075971036, "jspeiFindInScopes": 1075910904,
    "jspReplaceWith": 1075904248, "jspeFunctionCall": 1076010408, "jspGetNamedVariable": 1075912700, "jspGetNamedField": 1075923460, "jspGetVarNamedField": 1075922944,
    "jsvNewWithFlags": 1075999608 }
 }

It works with the 0x3ff00054 address:

>peek32(0x3ff00054).toString(16)
="20000d9"
>E.memoryArea(0x3ff00054,4);
>E.memoryArea(0x3ff00054,4);
="\xD9\x00\x00\x02"

So this seems to be associated with the address....

https://github.com/espruino/Espruino/wiki/ESP8266-Design-Notes