diff --git a/NEWS b/NEWS
index d6688b2e..2fcd70e4 100644
--- a/NEWS
+++ b/NEWS
@@ -181,6 +181,8 @@ ELinks 0.11.4.GIT now:
 
 To be released as 0.11.5.
 
+* critical bug 1027 in user SMJS: make elinks.keymaps treat null and
+  "none" as equivalent actions, avoiding a segfault
 * build bug 1021: fixed uninitialized variable in http_got_header
 
 ELinks 0.11.4:
diff --git a/doc/smjs-scripting.txt b/doc/smjs-scripting.txt
index ef9d80ab..34221cd4 100644
--- a/doc/smjs-scripting.txt
+++ b/doc/smjs-scripting.txt
@@ -244,12 +244,21 @@ rather than save it in a variable and call it later.
 	Currently, there are three: 'elinks.keymaps.main', 'elinks.keymaps.edit',
 	and 'elinks.keymaps.menu'. These elements are also hashes, the elements of
 	which correspond to bindings. For example, `elinks.keymaps.main["q"]` is
-	the binding to the ``q'' key in the main map. These bindings can be red,
-	to get the name of the action to which the key is bound, or set, either
-	to a string with the name of the ELinks action or to a function, which will
-	thenceforth be called when the key is pressed. For example,
+	the binding to the ``q'' key in the main map. These bindings can be read,
+	to get the name of the action to which the key is bound, or set to one of:
 +
 --
+- A string with the name of the ELinks action.
+- A function, which will thenceforth be called when the key is pressed.
+- The string `"none"`, to unbind the key.  You can also use the `null`
+  value for this purpose, but that crashes ELinks 0.11.4 and 0.12pre1
+  (http://bugzilla.elinks.cz/show_bug.cgi?id=1027[bug 1027]),
+  so it may be best to use the string for now.
+--
++
+--
+For example,
+
 ----------------------------------------------------------------------
 elinks.keymaps.main["!"] = function () { elinks.alert("Hello!"); }
 ----------------------------------------------------------------------
@@ -264,7 +273,7 @@ elinks.keymaps.main["/"] = "search-typeahead-text";
 changes the ``/'' key to use the nice typeahead search function instead of
 opening that ugly old search dialogue box.
 
-*Compatibility:* ELinks 0.11.0
+*Compatibility:* ELinks 0.11.0, unless you use `null`.
 
 NOTE: Do not read a function from <<smjs-elinks.action,'elinks.action'>>,
 e.g. `elinks.action.search_typeahead_text`, and place it in a keymap.
diff --git a/src/scripting/smjs/keybinding.c b/src/scripting/smjs/keybinding.c
index eff4c545..8c2f697b 100644
--- a/src/scripting/smjs/keybinding.c
+++ b/src/scripting/smjs/keybinding.c
@@ -37,7 +37,7 @@ keymap_get_property(JSContext *ctx, JSObject *obj, jsval id, jsval *vp)
 
 	action_str = get_action_name_from_keystroke((enum keymap_id) *data,
 						    keystroke_str);
-	if (!action_str) goto ret_null;
+	if (!action_str || !strcmp(action_str, "none")) goto ret_null;
 
 	*vp = STRING_TO_JSVAL(JS_NewStringCopyZ(ctx, action_str));
 
@@ -106,6 +106,12 @@ keymap_set_property(JSContext *ctx, JSObject *obj, jsval id, jsval *vp)
 
 		return JS_TRUE;
 
+	} else if (JSVAL_IS_NULL(*vp)) { /* before JSVAL_IS_OBJECT */
+		if (bind_do(keymap_str, keystroke_str, "none", 0))
+			return JS_FALSE;
+
+		return JS_TRUE;
+
 	} else if (JSVAL_IS_OBJECT(*vp)) {
 		unsigned char *err = NULL;
 		int event_id;