I _think_ what's going on is this: when given a call to (say) Shape 1066, Blitz
calculates the structure's address as shapebase (Addr Shape(0)) plus offset 
(shapenum LSL 5); the latter because like all Blitz2 system structs
Sizeof.shape is a power of 2, and (LSL #5,d0) is a lot faster than (MULU
#32,d0). Unfortunately, when shapenum is 1024 (%0000010000000000) or greater,
this LSL shifts a 1 into the most significant bit, and the offset becomes a
negative number _way_ outside the memory allocated for shape structs. If it
finds something at that address (could be anything), it assumes that there's
already a shape with that number, tries to Free it, and falls over because the
memory (pointed to by what it thinks is \_data) isn't Blitz's to free. 

Does that make sense?

I've posted this report to Acid (twice) but without results. :-(
The only solution I've found is this:

1/ Define a Newtype identical to the Shape struct.
2/ Declare an array of 2000 elements of this type. These can be accessed
safely since Blitz calculates array offsets using MULU, not LSL.
3/ Load your shape data into this array. Sounds like you've already got a
routine to do this, but if not just use Readmem to load the struct into an
element of the array, Allocmem to allocate enough chipmem for the bitmap data,
and another Readmem to load it in. You'll also need to code your own routines
to handle things like CopyShape, Free Shape, XFlip, YFlip etc if you want to
use them. Yes, it's a pain, but it works.
4/ When you want to Blit one of these pseudo-shapes, you do it via a dummy
system Shape, e.g. Shape(0). Make sure this is free, then copy the data from
your array element over to Addr Shape(0), Blit Shape 0 as usual, then clear the
Shape(0) data struct (DON'T use Free, or you'll lose your data and you'll get
an "Unable to free memory" at exit).

There you go. It took me a while to implement, but it's now working perfectly
and actually has some advantages (much easier to access shapes, and better/more
flexible use of system resources). Give it a go, and feel free to mail me or
post here if you get stuck. Alternatively, buy a chainsaw and a ticket to New
Zealand and persuade Acid to fix it themselves.

While I'm here, does anyone out there know where I can get hold of the register
addresses for the AGA blitter? It would be a godsend.