The load_addr property relies on there being a variable called "target" in the current module. It is explicitly marked only to be used in the interactive interpreter, and not in commands.
We used to be sloppy about leaving lldb.target sitting around in the script interpreter between uses of the interactive interpreter, so this mostly worked (unless the current target the last time you used the script interpreter wasn't the current target when you ran the command...)
But Jonas cleaned that up a little while ago. That uncovered the bug in save_crashlog.
I added a quick test. You could definitely do more rigorous testing of the output here, but this is better than the previous nothing, and what I have time for.