Aha!
I've done a little more debugging, and it turns out that the Postfix 'master' program was segfaulting. I enabled coredumps and managed to get a backtrace:
mahoromatic:/opt/zimbra/postfix-2.2.9/spool# gdb ../libexec/master core
GNU gdb 6.6-debian
Copyright (C) 2006 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB. Type "show warranty" for details.
This GDB was configured as "i486-linux-gnu"...
Using host libthread_db library "/lib/tls/i686/cmov/libthread_db.so.1".
warning: Can't read pathname for load map: Input/output error.
Reading symbols from /usr/lib/libpcre.so.3...done.
Loaded symbols for /usr/lib/libpcre.so.3
Reading symbols from /opt/zimbra/lib/libldap-2.3.so.0...done.
Loaded symbols for /opt/zimbra/lib/libldap-2.3.so.0
Reading symbols from /opt/zimbra/lib/liblber-2.3.so.0...done.
Loaded symbols for /opt/zimbra/lib/liblber-2.3.so.0
Reading symbols from /opt/zimbra/lib/libmysqlclient.so.15...done.
Loaded symbols for /opt/zimbra/lib/libmysqlclient.so.15
Reading symbols from /usr/lib/libz.so.1...done.
Loaded symbols for /usr/lib/libz.so.1
Reading symbols from /lib/tls/i686/cmov/libm.so.6...done.
Loaded symbols for /lib/tls/i686/cmov/libm.so.6
Reading symbols from /opt/zimbra/cyrus-sasl-2.1.21.ZIMBRA/lib/libsasl2.so.2...done.
Loaded symbols for /opt/zimbra/cyrus-sasl/lib/libsasl2.so.2
Reading symbols from /lib/tls/i686/cmov/libpthread.so.0...done.
Loaded symbols for /lib/tls/i686/cmov/libpthread.so.0
Reading symbols from /usr/lib/i686/cmov/libssl.so.0.9.8...done.
Loaded symbols for /usr/lib/i686/cmov/libssl.so.0.9.8
Reading symbols from /usr/lib/i686/cmov/libcrypto.so.0.9.8...done.
Loaded symbols for /usr/lib/i686/cmov/libcrypto.so.0.9.8
Reading symbols from /lib/tls/i686/cmov/libnsl.so.1...done.
Loaded symbols for /lib/tls/i686/cmov/libnsl.so.1
Reading symbols from /lib/tls/i686/cmov/libresolv.so.2...done.
Loaded symbols for /lib/tls/i686/cmov/libresolv.so.2
Reading symbols from /lib/tls/i686/cmov/libc.so.6...done.
Loaded symbols for /lib/tls/i686/cmov/libc.so.6
Reading symbols from /lib/tls/i686/cmov/libcrypt.so.1...done.
Loaded symbols for /lib/tls/i686/cmov/libcrypt.so.1
Reading symbols from /lib/ld-linux.so.2...done.
Loaded symbols for /lib/ld-linux.so.2
Reading symbols from /lib/tls/i686/cmov/libdl.so.2...done.
Loaded symbols for /lib/tls/i686/cmov/libdl.so.2
Reading symbols from /usr/lib/libxml2.so.2...done.
Loaded symbols for /usr/lib/libxml2.so.2
Reading symbols from /lib/tls/i686/cmov/libnss_compat.so.2...done.
Loaded symbols for /lib/tls/i686/cmov/libnss_compat.so.2
Reading symbols from /lib/tls/i686/cmov/libnss_nis.so.2...done.
Loaded symbols for /lib/tls/i686/cmov/libnss_nis.so.2
Reading symbols from /lib/tls/i686/cmov/libnss_files.so.2...done.
Loaded symbols for /lib/tls/i686/cmov/libnss_files.so.2
Reading symbols from /usr/lib/libnss_db.so.2...done.
Loaded symbols for /usr/lib/libnss_db.so.2
Reading symbols from /usr/lib/libdb-4.3.so...done.
Loaded symbols for /usr/lib/libdb-4.3.so
Core was generated by `/opt/zimbra/postfix-2.2.9/libexec/master'.
Program terminated with signal 11, Segmentation fault.
#0 0x080e8903 in __db_close_pp ()
(gdb) bt
#0 0x080e8903 in __db_close_pp ()
#1 0xb789f6ed in ?? () from /usr/lib/libnss_db.so.2
#2 0x08145780 in ?? ()
#3 0x00000000 in ?? ()
One of my theories is that it might actually be an ABI incompatibility between the NSS on Ubuntu 6.06 and that on 7.04.