One of the LLSelectNode constructors has a leak where it does "new LLPermisions()" twice, thus leaking the address of the first object created.
This constructor is called every time you interact (click, hover, select, possibly other) with an object, once for each prim in the object. Since sizeof(LLPermissions) is 92 bytes, this can be a significant amount after a while.
I think this might explain
VWR-18528 (leaking LLpemissions instances), at least partially.
This was fixed in snowglobe 1.x as part of SNOW-267.