Do you have the possibility to run "syncevolution --daemon=no" for the failing
sync under valgrind?

The steps during merging are the same as in my own test:
- script doesn't do anything
- winning PHOTO value is the URI from the local side
- when modifying the copy in EDS, a read/write cycle is involved
- during that step the PHOTO value gets corrupted.

This looks like plain old memory corruption to me. I'll try that myself
tomorrow, perhaps using a larger photo.