Hi Johannes,
for bootstrapping core, I'd create a custom (statically compiled) program that merely performs a 'chdir /genode' followed by 'execve '/genode/core'. This keeps core clean of the bootstrapping magic. This bootstrapping program can be called '/init' whereas everything Genode-related resides as '/genode/'.
I have no good idea about the segfault though. It definitely happens in init, not core because the fault occurs in 'ld.lib.so', which is not used by core. You may inspect the debug version of the ld.lib.so binary (using 'objdump -lSd debug/ld-linux.lib.so') at the faulting ip. The offset from the start of 'ld-linux.lib.so' can be calculated by subtracting the load address of ld.lib.so (as reported by the kernel) from the ip of the fault.
Cheers Norman