I guess you compiled with -DNDEBUG because all these out of bounds accesses are caught by asserts here. They are fixed in the devel and 3.2 branch, and SparseQR works for me with rows<cols.
Regarding AmbiVector, replacing allocations by operator new with malloc, plus a few inplace construct and destruct should do the job.