The change in proftpd 1.3.6 is fairly crazy; it does a per-character read of /etc/group, multiplied by every file in a directory, as it builds the output. So if your /etc/group is a kilobyte, and you have 10,000 files in a directory, it's going to do a minimum of ten million read() function...