In this comment @tynes discovered a possible nil-pointer dereference. In spanBatchTxs.fullTxs, the to address pointer is only set if this is not a contract creation. But a maliciously formed span batch may set this bit for a setCode tx. We need to check for this and return an error.